From 185fce8e17f39ce91574d98709558007bc4fa252 Mon Sep 17 00:00:00 2001 From: Chris Farhood <3+cpfarhood@noreply.git.farh.net> Date: Sun, 24 May 2026 18:14:57 +0000 Subject: [PATCH 01/14] Add .mcp.json --- .mcp.json | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 .mcp.json diff --git a/.mcp.json b/.mcp.json new file mode 100644 index 0000000..6efc1ca --- /dev/null +++ b/.mcp.json @@ -0,0 +1,11 @@ +{ + "mcpServers": { + "gitea": { + "type": "http", + "url": "https://git-mcp.farh.net/mcp", + "headers": { + "Authorization": "Bearer ${GITEA_TOKEN}" + } + } + } +} From dd83f2973640b9c68d343f5a2e66b363809dfec5 Mon Sep 17 00:00:00 2001 From: Flea Flicker Date: Mon, 25 May 2026 23:22:04 +0000 Subject: [PATCH 02/14] chore: trigger CI from uat for GRO-1754 --- trigger-uat-1779751324.txt | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 trigger-uat-1779751324.txt diff --git a/trigger-uat-1779751324.txt b/trigger-uat-1779751324.txt new file mode 100644 index 0000000..e69de29 From 152abfc4d55d167782efa89d11cad3b9264b56fe Mon Sep 17 00:00:00 2001 From: The Dogfather <20+gb_dogfather@noreply.git.farh.net> Date: Tue, 26 May 2026 01:26:05 +0000 Subject: [PATCH 03/14] fix(ci): remove duplicate provenance keys causing YAML parse error Duplicate 'provenance: false' in each docker/build-push-action step caused Gitea to reject the workflow file, breaking push CI and workflow_dispatch. Co-Authored-By: Paperclip --- .gitea/workflows/ci.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index b08c640..b37a76a 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -96,7 +96,6 @@ jobs: file: Dockerfile target: runner push: true - provenance: false tags: | git.farh.net/groombook/api:${{ steps.version.outputs.tag }} ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }} @@ -111,7 +110,6 @@ jobs: file: Dockerfile target: migrate push: true - provenance: false tags: | git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }} ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }} @@ -126,7 +124,6 @@ jobs: file: Dockerfile target: seed push: true - provenance: false tags: | git.farh.net/groombook/seed:${{ steps.version.outputs.tag }} ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }} @@ -141,7 +138,6 @@ jobs: file: Dockerfile target: reset push: true - provenance: false tags: | git.farh.net/groombook/reset:${{ steps.version.outputs.tag }} ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }} From e9ad92de01d383aefcd23e75f72cbb188aa6034b Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Tue, 9 Jun 2026 01:23:06 +0000 Subject: [PATCH 04/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2157=20n?= =?UTF-8?q?av=20export=20+=20GRO-2225/2235=20(frozen=20@4868f18)=20(#192)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit feat: nav export + conflict guard + UAT seed (GRO-2157, GRO-2225, GRO-2235) Squash-merges PR #192: uat→main PROD promotion. Freezes at validated SHA 4868f18 (UAT regression GRO-2261 11/11 PASS). Bundles: GRO-2157 (nav export), GRO-2225 (UAT seed), GRO-2235 (conflict guard). CTO-reviewed and approved (review #4542). Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- UAT_PLAYBOOK.md | 30 ++- packages/db/src/seed.ts | 210 ++++++++++++++++++ src/__tests__/navigationExport.test.ts | 140 ++++++++++++ src/__tests__/portalWaitlistDuplicate.test.ts | 154 +++++++++++++ src/routes/portal.ts | 36 ++- src/routes/routes.ts | 69 +++++- src/services/navigationExport.ts | 155 +++++++++++++ 7 files changed, 782 insertions(+), 12 deletions(-) create mode 100644 src/__tests__/navigationExport.test.ts create mode 100644 src/__tests__/portalWaitlistDuplicate.test.ts create mode 100644 src/services/navigationExport.ts diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index d590556..78b73f3 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -365,7 +365,12 @@ This means: ### 4.16 Route Optimization — Route CRUD + Optimize (GRO-2155, Phase 2.1) -A groomer's daily route is one row per `(staffId, routeDate)` in `groomer_routes`, with ordered `route_stops`. `POST /api/routes/optimize` pulls the day's non-cancelled appointments whose client is geocoded (GRO-2154), orders them (Google Directions `optimizeWaypoints` when a key is configured in `businessSettings.googleMapsApiKey`, else an offline nearest-neighbor heuristic), and persists `stopOrder`, `travelMinsFromPrev`, `travelDistanceKmFromPrev` plus route `totalTravelMins`/`totalDistanceKm`/`optimizedAt`. **Auth: manager (any groomer's route) or groomer (own route only); receptionists have no access.** Pre-condition: at least one geocoded client with appointments on the target date for the staff member (use §4.2 geocoding + a seed groomer). +A groomer's daily route is one row per `(staffId, routeDate)` in `groomer_routes`, with ordered `route_stops`. `POST /api/routes/optimize` pulls the day's non-cancelled appointments whose client is geocoded (GRO-2154), orders them (Google Directions `optimizeWaypoints` when a key is configured in `businessSettings.googleMapsApiKey`, else an offline nearest-neighbor heuristic), and persists `stopOrder`, `travelMinsFromPrev`, `travelDistanceKmFromPrev` plus route `totalTravelMins`/`totalDistanceKm`/`optimizedAt`. **Auth: manager (any groomer's route) or groomer (own route only); receptionists have no access.** + +**Pre-condition (GRO-2225 — zero-touch; no manual PATCH/geocoding needed).** A fresh UAT reset+seed now provisions a deterministic route cohort, so §4.16 runs directly against seed data: +- **Groomer:** `uat-groomer@groombook.dev` (staffId `00000000-0000-0000-0000-000000000004`). Resolve its id via `GET /api/staff` or sign in as the groomer and omit `staffId`. +- **Date:** `2026-09-15` (fixed). On this date the groomer has **12** confirmed appointments: **10 pre-geocoded** clients clustered in the Seattle metro (multi-stop route) + **2 intentionally un-geocoded** clients (exercise the skip-and-surface path, TC-API-16.4). Cohort clients are named `Route Demo — …` (emails `route-client-NN@uat.groombook.dev`). +- **Receptionist (TC-API-16.9 403):** sign in as `uat-receptionist@groombook.dev` (password from the `seed-uat-passwords` secret, key `SEED_UAT_RECEPTIONIST_PASSWORD`) — a standing receptionist login; no hand-built session required. | # | Scenario | Steps | Expected | |---|----------|-------|----------| @@ -403,6 +408,29 @@ Builds on §4.16. After optimization each consecutive leg carries a travel `buff | TC-API-17.7 | Reorder invalid routeId | `PATCH /api/routes/not-a-uuid/reorder` | 400 `{ error: "routeId must be a UUID" }` | | TC-API-17.8 | Groomer cannot reorder another's route | As groomer, reorder a route owned by a different groomer | 403 Forbidden (`groomers may only access their own route`) | +### 4.18 Route Optimization — Navigation Export (GRO-2157, Phase 2.3) + +Builds on §4.16/§4.17. Two read-only endpoints turn an optimized route into a native-navigation deep-link URL the frontend opens on the groomer's phone: + +- `GET /api/routes/:routeId/export/google-maps` → Google Maps URLs API link (`https://www.google.com/maps/dir/?api=1&travelmode=driving&origin=…&destination=…&waypoints=…`) +- `GET /api/routes/:routeId/export/apple-maps` → Apple Maps URL scheme (`maps://?saddr=…&daddr=+to:…&dirflg=d`) + +Both use the stops' stored `latitude`/`longitude` in `stopOrder`: **origin = first stop, destination = last stop, the rest are ordered intermediate waypoints**. Each response body is `{ platform, url, stopCount, waypointCount }` where `waypointCount` = stops minus origin and destination. Waypoint limits are validated per platform: **Google Maps ≤ 9**, **Apple Maps ≤ 15** intermediate waypoints; over-limit routes return 400. **Auth: manager (any route) or groomer (own route only); receptionists have no access.** + +| ID | Scenario | Steps | Expected | +|----|----------|-------|----------| +| TC-API-18.1 | Google Maps export of a multi-stop route | As manager, optimize a multi-stop day (§4.16), then `GET /api/routes/{routeId}/export/google-maps` | 200 OK; `platform:"google-maps"`, `url` starts `https://www.google.com/maps/dir/?api=1`, contains `travelmode=driving`, `origin`/`destination` are the first/last stop coords, `waypoints` lists the middle stops in order (pipe-separated). `stopCount` = total stops, `waypointCount` = `stopCount − 2` | +| TC-API-18.2 | Apple Maps export of a multi-stop route | As manager, `GET /api/routes/{routeId}/export/apple-maps` for the same route | 200 OK; `platform:"apple-maps"`, `url` starts `maps://?saddr=`, `daddr` chains the remaining stops with `+to:`, ends `&dirflg=d`; `stopCount`/`waypointCount` as above | +| TC-API-18.3 | Single-stop route | Export a route (google-maps and apple-maps) that has exactly one stop | 200 OK; `waypointCount:0`. Google url has `destination` and no `waypoints=`; Apple url is `maps://?daddr=&dirflg=d` (no `saddr`) | +| TC-API-18.4 | Empty route rejected | Export a route with no stops (a fresh `draft` route) | 400 `{ error: "route has no stops to export" }` | +| TC-API-18.5 | Google waypoint limit | Export (google-maps) a route with >11 stops (>9 intermediate waypoints) | 400 with an `error` mentioning Google Maps' limit of 9 | +| TC-API-18.6 | Apple waypoint limit | Export (apple-maps) a route with >17 stops (>15 intermediate waypoints) | 400 with an `error` mentioning Apple Maps' limit of 15 | +| TC-API-18.7 | Unknown route | `GET /api/routes/{randomUuid}/export/google-maps` | 404 `{ error: "Route not found" }` | +| TC-API-18.8 | Invalid routeId | `GET /api/routes/not-a-uuid/export/apple-maps` | 400 `{ error: "routeId must be a UUID" }` | +| TC-API-18.9 | Groomer exports own route | As **groomer**, export a route owned by self | 200 OK; deep-link returned | +| TC-API-18.10 | Groomer cannot export another's route | As groomer, export a route owned by a different groomer | 403 Forbidden (`groomers may only access their own route`) | +| TC-API-18.11 | Receptionist denied | As **receptionist**, export any route | 403 Forbidden (role not permitted) | + ## Pass/Fail Criteria **Pass:** diff --git a/packages/db/src/seed.ts b/packages/db/src/seed.ts index 0959be0..55b2ee4 100644 --- a/packages/db/src/seed.ts +++ b/packages/db/src/seed.ts @@ -456,6 +456,36 @@ async function seedUatStaffAccounts( } } + // ── Staff: UAT Receptionist (GRO-2225) ────────────────────────────────────── + // Standing receptionist staff record so the route-optimization 403 path + // (TC-API-16.9: receptionist GET/POST /api/routes → 403) is reproducible + // without a hand-built session. The matching Better-Auth credential is + // provisioned below from SEED_UAT_RECEPTIONIST_PASSWORD. Created here (gated + // on the password env) so the credential loop's staff-link step finds it. + if (process.env.SEED_UAT_RECEPTIONIST_PASSWORD) { + const UAT_RECEPTIONIST_STAFF_ID = "00000000-0000-0000-0000-000000000099"; + const [existingReceptionist] = await db + .select() + .from(schema.staff) + .where(eq(schema.staff.email, "uat-receptionist@groombook.dev")) + .limit(1); + + if (existingReceptionist) { + console.log(`✓ Staff 'UAT Receptionist' already exists — skipping`); + } else { + await db.insert(schema.staff).values({ + id: UAT_RECEPTIONIST_STAFF_ID, + name: "UAT Receptionist", + email: "uat-receptionist@groombook.dev", + oidcSub: "uat-receptionist@groombook.dev", + role: "receptionist", + isSuperUser: false, + active: true, + }); + console.log(`✓ Created staff 'UAT Receptionist' (uat-receptionist@groombook.dev)`); + } + } + // ── Staff: UAT Groomer Personas (SEED_UAT_GROOMER_EMAILS + SEED_UAT_GROOMER_NAMES) ── const groomerEmails = process.env.SEED_UAT_GROOMER_EMAILS?.split(",").map((e) => e.trim()).filter(Boolean) ?? []; const groomerNames = process.env.SEED_UAT_GROOMER_NAMES?.split(",").map((n) => n.trim()).filter(Boolean) ?? []; @@ -495,6 +525,8 @@ async function seedUatStaffAccounts( { email: "uat-groomer@groombook.dev", name: "UAT Staff Groomer", passwordEnv: "SEED_UAT_GROOMER_PASSWORD", staffEmail: "uat-groomer@groombook.dev" }, { email: "uat-customer@groombook.dev", name: "UAT Customer", passwordEnv: "SEED_UAT_CUSTOMER_PASSWORD", staffEmail: null }, { email: "uat-tester@groombook.dev", name: "UAT Tester", passwordEnv: "SEED_UAT_TESTER_PASSWORD", staffEmail: "uat-tester@groombook.dev" }, + // GRO-2225: standing receptionist login for the route-optimization 403 path (TC-API-16.9). + { email: "uat-receptionist@groombook.dev", name: "UAT Receptionist", passwordEnv: "SEED_UAT_RECEPTIONIST_PASSWORD", staffEmail: "uat-receptionist@groombook.dev" }, ]; for (const acct of uatPasswordAccounts) { @@ -798,6 +830,179 @@ async function seedUatGroomerLinkage( ); } +// ── GRO-2225: deterministic route-optimization cohort ──────────────────────── + +/** + * GRO-2225: seed a deterministic, pre-geocoded client cohort + a fixed-date set + * of appointments for the UAT groomer so the route-optimization endpoints + * (`GET /api/routes/daily`, `POST /api/routes/optimize`, UAT §4.16 + * TC-API-16.1…16.11) are exercisable with ZERO manual PATCHing. + * + * Design (no live geocoder — UAT has no Google Maps key, provider is + * nearest_neighbor; coordinates are hand-picked fixtures clustered in the + * Seattle metro): + * - All appointments are on a FIXED calendar date (ROUTE_DATE) and assigned to + * the UAT groomer (`uat-groomer@groombook.dev`). The optimize endpoint pulls + * non-cancelled appointments in [date 00:00Z, +24h) joined to client coords. + * - 10 clients carry deterministic lat/lng → a multi-stop optimized route. + * - 2 clients are intentionally left UN-geocoded so the "skipped + surfaced" + * path (TC-API-16.5) stays reproducible. + * + * Idempotent: clients/pets are upserted by fixed UUID (they are NOT truncated on + * reset); appointments are upserted by fixed UUID too (they ARE truncated on + * reset, but the upsert keeps re-runs safe in non-truncating dev/test paths). + * Skips cleanly when the UAT groomer staff record is absent (e.g. prod/demo or a + * dev seed without the UAT personas). + */ +async function seedUatRouteCohort(db: ReturnType): Promise { + // Fixed calendar date the UAT playbook hardcodes for §4.16. Times are UTC so + // they fall inside the optimize endpoint's [date 00:00Z, +24h) day window. + const ROUTE_DATE = "2026-09-15"; + + const [uatGroomer] = await db + .select({ id: schema.staff.id }) + .from(schema.staff) + .where(eq(schema.staff.email, "uat-groomer@groombook.dev")) + .limit(1); + if (!uatGroomer) { + console.log("✓ GRO-2225: uat-groomer not present — skipping route cohort"); + return; + } + + // Resolve a service for the appointments: prefer Bath & Brush, else any active. + const BATH_AND_BRUSH_ID = "b0000001-0000-0000-0000-000000000001"; + const [bathService] = await db + .select({ id: schema.services.id }) + .from(schema.services) + .where(eq(schema.services.id, BATH_AND_BRUSH_ID)) + .limit(1); + let serviceId: string; + if (bathService) { + serviceId = bathService.id; + } else { + const [fallback] = await db + .select({ id: schema.services.id }) + .from(schema.services) + .where(eq(schema.services.active, true)) + .limit(1); + if (!fallback) { + console.warn("⚠ GRO-2225: no active services found — skipping route cohort"); + return; + } + serviceId = fallback.id; + } + + // Hand-picked fixture coordinates clustered in the Seattle metro. `coords:null` + // marks an intentionally un-geocoded client (skip-and-surface path TC-16.5). + const cohort: Array<{ + n: number; + name: string; + coords: { lat: number; lng: number } | null; + }> = [ + { n: 1, name: "Route Demo — Ada Lovelace", coords: { lat: 47.6097, lng: -122.3331 } }, + { n: 2, name: "Route Demo — Grace Hopper", coords: { lat: 47.6205, lng: -122.3493 } }, + { n: 3, name: "Route Demo — Alan Turing", coords: { lat: 47.5990, lng: -122.3300 } }, + { n: 4, name: "Route Demo — Katherine Johnson", coords: { lat: 47.6150, lng: -122.3200 } }, + { n: 5, name: "Route Demo — Edsger Dijkstra", coords: { lat: 47.6280, lng: -122.3550 } }, + { n: 6, name: "Route Demo — Barbara Liskov", coords: { lat: 47.5920, lng: -122.3150 } }, + { n: 7, name: "Route Demo — Donald Knuth", coords: { lat: 47.6350, lng: -122.3400 } }, + { n: 8, name: "Route Demo — Margaret Hamilton", coords: { lat: 47.6050, lng: -122.3600 } }, + { n: 9, name: "Route Demo — Ken Thompson", coords: { lat: 47.6420, lng: -122.3250 } }, + { n: 10, name: "Route Demo — Radia Perlman", coords: { lat: 47.5880, lng: -122.3450 } }, + // Intentionally un-geocoded — exercises the skip-and-surface path. + { n: 11, name: "Route Demo — Ungeocoded One", coords: null }, + { n: 12, name: "Route Demo — Ungeocoded Two", coords: null }, + ]; + + // Stagger appointments 45 min apart starting 15:00Z on ROUTE_DATE. + const dayStartMs = new Date(`${ROUTE_DATE}T15:00:00.000Z`).getTime(); + const SLOT_MS = 45 * 60 * 1000; + + let geocodedCount = 0; + let ungeocodedCount = 0; + for (const c of cohort) { + const pad = String(c.n).padStart(2, "0"); + const clientId = `d0000000-0000-0000-0000-0000000000${pad}`; + const petId = `d0000000-0000-0000-0000-0000000001${pad}`; + const apptId = `d0000000-0000-0000-0000-0000000002${pad}`; + const geocodedAt = c.coords ? new Date(`${ROUTE_DATE}T00:00:00.000Z`) : null; + + await db.insert(schema.clients) + .values({ + id: clientId, + name: c.name, + email: `route-client-${pad}@uat.groombook.dev`, + phone: `(206) 555-01${pad}`, + address: `${100 + c.n} Pike Street, Seattle, WA 98101`, + status: "active", + latitude: c.coords?.lat ?? null, + longitude: c.coords?.lng ?? null, + geocodedAt, + }) + .onConflictDoUpdate({ + target: schema.clients.id, + set: { + name: c.name, + address: `${100 + c.n} Pike Street, Seattle, WA 98101`, + latitude: c.coords?.lat ?? null, + longitude: c.coords?.lng ?? null, + geocodedAt, + }, + }); + + await db.insert(schema.pets) + .values({ + id: petId, + clientId, + name: `Route Pup ${c.n}`, + species: "Dog", + breed: "Mixed", + weightKg: "18.00", + }) + .onConflictDoUpdate({ + target: schema.pets.id, + set: { clientId, name: `Route Pup ${c.n}`, species: "Dog" }, + }); + + const startTime = new Date(dayStartMs + (c.n - 1) * SLOT_MS); + const endTime = new Date(startTime.getTime() + SLOT_MS); + await db.insert(schema.appointments) + .values({ + id: apptId, + clientId, + petId, + serviceId, + staffId: uatGroomer.id, + batherStaffId: null, + status: "confirmed", + startTime, + endTime, + notes: "GRO-2225: deterministic route-optimization cohort appointment.", + priceCents: null, + confirmationStatus: "confirmed", + }) + .onConflictDoUpdate({ + target: schema.appointments.id, + set: { + clientId, + petId, + serviceId, + staffId: uatGroomer.id, + status: "confirmed", + startTime, + endTime, + }, + }); + + if (c.coords) geocodedCount++; + else ungeocodedCount++; + } + + console.log( + `✓ GRO-2225: seeded route cohort for ${ROUTE_DATE} — ${geocodedCount} geocoded + ${ungeocodedCount} un-geocoded appointment(s) for uat-groomer (${uatGroomer.id})`, + ); +} + // ── Known-users-only seed (prod/demo) ─────────────────────────────────────── /** @@ -1169,6 +1374,11 @@ async function runSeedBody( // the time seedUatStaffAccounts() returns). await seedUatGroomerLinkage(db, uatCustomerClientId); + // GRO-2225: deterministic pre-geocoded route cohort + fixed-date appointments + // for the UAT groomer. Must run AFTER services are seeded (it looks up a + // service id for the appointments). Skips cleanly if uat-groomer is absent. + await seedUatRouteCohort(db); + // ── Clients & Pets ── const now = new Date(); const appointmentsBackDate = new Date(now); diff --git a/src/__tests__/navigationExport.test.ts b/src/__tests__/navigationExport.test.ts new file mode 100644 index 0000000..902cb9d --- /dev/null +++ b/src/__tests__/navigationExport.test.ts @@ -0,0 +1,140 @@ +import { describe, it, expect } from "vitest"; +import { + buildGoogleMapsUrl, + buildAppleMapsUrl, + buildNavigationUrl, + intermediateWaypointCount, + GOOGLE_MAPS_MAX_WAYPOINTS, + APPLE_MAPS_MAX_WAYPOINTS, + type NavigationStop, +} from "../services/navigationExport.js"; + +function stops(n: number): NavigationStop[] { + return Array.from({ length: n }, (_, i) => ({ + latitude: 47 + i / 100, + longitude: -122 - i / 100, + label: `Stop ${i + 1}`, + })); +} + +describe("intermediateWaypointCount", () => { + it("excludes origin and destination", () => { + expect(intermediateWaypointCount(0)).toBe(0); + expect(intermediateWaypointCount(1)).toBe(0); + expect(intermediateWaypointCount(2)).toBe(0); + expect(intermediateWaypointCount(5)).toBe(3); + }); +}); + +describe("buildGoogleMapsUrl", () => { + it("rejects an empty route", () => { + const r = buildGoogleMapsUrl([]); + expect(r).toEqual({ error: "route has no stops to export", status: 400 }); + }); + + it("builds a single-stop link (destination only, no waypoints)", () => { + const r = buildGoogleMapsUrl(stops(1)); + if ("error" in r) throw new Error(r.error); + expect(r.platform).toBe("google-maps"); + expect(r.stopCount).toBe(1); + expect(r.waypointCount).toBe(0); + expect(r.url).toContain("https://www.google.com/maps/dir/?"); + expect(r.url).toContain("api=1"); + expect(r.url).toContain("travelmode=driving"); + expect(r.url).toContain("origin=47%2C-122"); + expect(r.url).toContain("destination=47%2C-122"); + expect(r.url).not.toContain("waypoints="); + }); + + it("builds origin/destination only for two stops", () => { + const r = buildGoogleMapsUrl(stops(2)); + if ("error" in r) throw new Error(r.error); + expect(r.waypointCount).toBe(0); + expect(r.url).not.toContain("waypoints="); + expect(r.url).toContain("origin=47%2C-122"); + expect(r.url).toContain("destination=47.01%2C-122.01"); + }); + + it("includes intermediate waypoints in order, pipe-separated", () => { + const r = buildGoogleMapsUrl(stops(4)); + if ("error" in r) throw new Error(r.error); + expect(r.stopCount).toBe(4); + expect(r.waypointCount).toBe(2); + // waypoints param holds stops[1] and stops[2], pipe-joined (encoded %7C) + const url = new URL(r.url); + expect(url.searchParams.get("origin")).toBe("47,-122"); + expect(url.searchParams.get("destination")).toBe("47.03,-122.03"); + expect(url.searchParams.get("waypoints")).toBe( + "47.01,-122.01|47.02,-122.02" + ); + }); + + it("accepts a route at exactly the waypoint limit", () => { + const r = buildGoogleMapsUrl(stops(GOOGLE_MAPS_MAX_WAYPOINTS + 2)); + if ("error" in r) throw new Error(r.error); + expect(r.waypointCount).toBe(GOOGLE_MAPS_MAX_WAYPOINTS); + }); + + it("rejects a route over the waypoint limit", () => { + const r = buildGoogleMapsUrl(stops(GOOGLE_MAPS_MAX_WAYPOINTS + 3)); + expect("error" in r).toBe(true); + if ("error" in r) { + expect(r.status).toBe(400); + expect(r.error).toContain(`${GOOGLE_MAPS_MAX_WAYPOINTS}`); + } + }); +}); + +describe("buildAppleMapsUrl", () => { + it("rejects an empty route", () => { + const r = buildAppleMapsUrl([]); + expect(r).toEqual({ error: "route has no stops to export", status: 400 }); + }); + + it("builds a destination-only link for one stop", () => { + const r = buildAppleMapsUrl(stops(1)); + if ("error" in r) throw new Error(r.error); + expect(r.platform).toBe("apple-maps"); + expect(r.url).toBe("maps://?daddr=47,-122&dirflg=d"); + expect(r.url).not.toContain("saddr="); + }); + + it("chains destinations with +to: for multiple stops", () => { + const r = buildAppleMapsUrl(stops(3)); + if ("error" in r) throw new Error(r.error); + expect(r.stopCount).toBe(3); + expect(r.waypointCount).toBe(1); + expect(r.url).toBe( + "maps://?saddr=47,-122&daddr=47.01,-122.01+to:47.02,-122.02&dirflg=d" + ); + }); + + it("accepts a route at exactly the waypoint limit", () => { + const r = buildAppleMapsUrl(stops(APPLE_MAPS_MAX_WAYPOINTS + 2)); + if ("error" in r) throw new Error(r.error); + expect(r.waypointCount).toBe(APPLE_MAPS_MAX_WAYPOINTS); + }); + + it("rejects a route over the waypoint limit", () => { + const r = buildAppleMapsUrl(stops(APPLE_MAPS_MAX_WAYPOINTS + 3)); + expect("error" in r).toBe(true); + if ("error" in r) { + expect(r.status).toBe(400); + expect(r.error).toContain(`${APPLE_MAPS_MAX_WAYPOINTS}`); + } + }); +}); + +describe("buildNavigationUrl", () => { + it("dispatches to the google-maps builder", () => { + const r = buildNavigationUrl("google-maps", stops(2)); + if ("error" in r) throw new Error(r.error); + expect(r.platform).toBe("google-maps"); + }); + + it("dispatches to the apple-maps builder", () => { + const r = buildNavigationUrl("apple-maps", stops(2)); + if ("error" in r) throw new Error(r.error); + expect(r.platform).toBe("apple-maps"); + }); +}); diff --git a/src/__tests__/portalWaitlistDuplicate.test.ts b/src/__tests__/portalWaitlistDuplicate.test.ts new file mode 100644 index 0000000..c0edbc6 --- /dev/null +++ b/src/__tests__/portalWaitlistDuplicate.test.ts @@ -0,0 +1,154 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { Hono } from "hono"; + +// GRO-2235: a duplicate active waitlist entry violates the partial unique index +// idx_waitlist_active_unique. postgres-js surfaces it as SQLSTATE 23505 — the +// handler must return a friendly 409, not a generic 500. The first insert still +// returns 201, and unrelated errors still surface as 500. + +const CLIENT_ID = "550e8400-e29b-41d4-a716-446655440001"; +const SESSION_ID = "770e8400-e29b-41d4-a716-446655440003"; +const PET_ID = "880e8400-e29b-41d4-a716-446655440004"; +const SERVICE_ID = "990e8400-e29b-41d4-a716-446655440005"; + +const futureDate = () => new Date(Date.now() + 30 * 60 * 1000); + +const ACTIVE_SESSION = { + id: SESSION_ID, + clientId: CLIENT_ID, + status: "active" as const, + reason: "manual", + startedAt: new Date(), + expiresAt: futureDate(), + createdAt: new Date(), +}; + +// Behaviour knob for the waitlist insert: "ok" returns a row, "duplicate" throws +// a postgres-js-shaped unique-violation, "other" throws an unrelated error. +let waitlistInsertMode: "ok" | "duplicate" | "other" = "ok"; + +function resetMock() { + waitlistInsertMode = "ok"; +} + +function tableProxy(name: string) { + return new Proxy( + { _name: name }, + { get: (t, p) => (p === "_name" ? name : { table: name, column: p }) } + ); +} + +vi.mock("@groombook/db", () => { + function makeChainable(data: unknown[]): unknown { + const arr = [...data]; + const chain = new Proxy(arr, { + get(target, prop) { + if (prop === "where" || prop === "orderBy" || prop === "limit") { + return () => chain; + } + // @ts-expect-error proxy + return target[prop]; + }, + }); + return chain; + } + + const impersonationSessions = tableProxy("impersonationSessions"); + const waitlistEntries = tableProxy("waitlistEntries"); + const impersonationAuditLogs = tableProxy("impersonationAuditLogs"); + + return { + getDb: () => ({ + select: () => ({ + from: (table: { _name: string }) => { + if (table._name === "impersonationSessions") { + return makeChainable([ACTIVE_SESSION]); + } + return makeChainable([]); + }, + }), + insert: (table: { _name: string }) => ({ + values: (vals: Record) => ({ + returning: () => { + if (table._name === "waitlistEntries") { + if (waitlistInsertMode === "duplicate") { + throw Object.assign(new Error("duplicate key value"), { code: "23505" }); + } + if (waitlistInsertMode === "other") { + throw Object.assign(new Error("not null violation"), { code: "23502" }); + } + return [{ id: "entry-1", ...vals }]; + } + // impersonationAuditLogs and anything else: succeed silently. + return [{ id: "audit-1", ...vals }]; + }, + }), + }), + update: () => ({ + set: () => ({ where: () => Promise.resolve() }), + }), + }), + impersonationSessions, + waitlistEntries, + impersonationAuditLogs, + appointments: tableProxy("appointments"), + clients: tableProxy("clients"), + pets: tableProxy("pets"), + services: tableProxy("services"), + staff: tableProxy("staff"), + invoices: tableProxy("invoices"), + invoiceLineItems: tableProxy("invoiceLineItems"), + eq: vi.fn(), + and: vi.fn(), + inArray: vi.fn(), + }; +}); + +const { portalRouter } = await import("../routes/portal.js"); + +const app = new Hono(); +app.route("/portal", portalRouter); + +function postWaitlist(body: unknown) { + return app.request("/portal/waitlist", { + method: "POST", + headers: { + "Content-Type": "application/json", + "X-Impersonation-Session-Id": SESSION_ID, + }, + body: JSON.stringify(body), + }); +} + +const VALID_BODY = { + petId: PET_ID, + serviceId: SERVICE_ID, + preferredDate: "2026-07-01", + preferredTime: "09:00", +}; + +beforeEach(() => resetMock()); + +describe("POST /portal/waitlist duplicate handling (GRO-2235)", () => { + it("returns 201 for the first insert", async () => { + waitlistInsertMode = "ok"; + const res = await postWaitlist(VALID_BODY); + expect(res.status).toBe(201); + }); + + it("returns 409 with a friendly message for a duplicate (23505)", async () => { + waitlistInsertMode = "duplicate"; + const res = await postWaitlist(VALID_BODY); + expect(res.status).toBe(409); + const json = (await res.json()) as { error: string }; + expect(json.error).toBe( + "You already have a booking for this pet at that date and time." + ); + }); + + it("still surfaces unrelated DB errors as 500", async () => { + waitlistInsertMode = "other"; + const res = await postWaitlist(VALID_BODY); + expect(res.status).toBe(500); + }); +}); diff --git a/src/routes/portal.ts b/src/routes/portal.ts index d614e51..3c7dab9 100644 --- a/src/routes/portal.ts +++ b/src/routes/portal.ts @@ -596,16 +596,32 @@ portalRouter.post( const body = c.req.valid("json"); const clientId = c.get("portalClientId"); - const [entry] = await db - .insert(waitlistEntries) - .values({ - clientId, - petId: body.petId, - serviceId: body.serviceId, - preferredDate: body.preferredDate, - preferredTime: normalizeTime(body.preferredTime), - }) - .returning(); + let entry; + try { + [entry] = await db + .insert(waitlistEntries) + .values({ + clientId, + petId: body.petId, + serviceId: body.serviceId, + preferredDate: body.preferredDate, + preferredTime: normalizeTime(body.preferredTime), + }) + .returning(); + } catch (err) { + // An exact duplicate active waitlist entry violates the partial unique + // index idx_waitlist_active_unique (client_id, pet_id, service_id, + // preferred_date, preferred_time WHERE status='active'). postgres-js + // surfaces this as SQLSTATE 23505 — return a friendly 409 rather than a + // generic 500 (GRO-2235). Unrelated errors still surface as 500. + if ((err as { code?: string })?.code === "23505") { + return c.json( + { error: "You already have a booking for this pet at that date and time." }, + 409 + ); + } + throw err; + } return c.json(entry, 201); } diff --git a/src/routes/routes.ts b/src/routes/routes.ts index 3bf905a..898b16a 100644 --- a/src/routes/routes.ts +++ b/src/routes/routes.ts @@ -1,4 +1,4 @@ -import { Hono } from "hono"; +import { Hono, type Context } from "hono"; import { zValidator } from "@hono/zod-validator"; import { z } from "zod/v3"; import { @@ -24,6 +24,11 @@ import { type RouteStopInput, type StopConflictFlags, } from "../services/routeOptimization.js"; +import { + buildNavigationUrl, + type NavigationPlatform, + type NavigationStop, +} from "../services/navigationExport.js"; export const routesRouter = new Hono(); @@ -460,3 +465,65 @@ routesRouter.patch( }); } ); + +/** + * GET /:routeId/export/:platform — build a native-navigation deep-link URL for an + * optimized route. Origin = first stop, destination = last stop, the rest carried + * as ordered intermediate waypoints. Waypoint count is validated against the + * platform's limit. Auth: manager (any route) or groomer (own route only). + */ +async function handleNavigationExport( + c: Context, + platform: NavigationPlatform +) { + const db = getDb(); + const routeId = c.req.param("routeId"); + if (!routeId || !z.string().uuid().safeParse(routeId).success) { + return c.json({ error: "routeId must be a UUID" }, 400); + } + + const [route] = await db + .select() + .from(groomerRoutes) + .where(eq(groomerRoutes.id, routeId)); + if (!route) { + return c.json({ error: "Route not found" }, 404); + } + + // Reuse the groomer-own / manager authorization rule against the route owner. + const resolved = resolveTargetStaffId(c.get("staff"), route.staffId); + if ("error" in resolved) { + return c.json({ error: resolved.error }, resolved.status); + } + + const stops = await loadRouteStops(db, routeId); + if (stops.length === 0) { + return c.json({ error: "route has no stops to export" }, 400); + } + + const navStops: NavigationStop[] = stops.map((s) => ({ + latitude: s.latitude, + longitude: s.longitude, + label: s.clientName, + })); + + const result = buildNavigationUrl(platform, navStops); + if ("error" in result) { + return c.json({ error: result.error }, result.status); + } + + return c.json({ + platform: result.platform, + url: result.url, + stopCount: result.stopCount, + waypointCount: result.waypointCount, + }); +} + +routesRouter.get("/:routeId/export/google-maps", (c) => + handleNavigationExport(c, "google-maps") +); + +routesRouter.get("/:routeId/export/apple-maps", (c) => + handleNavigationExport(c, "apple-maps") +); diff --git a/src/services/navigationExport.ts b/src/services/navigationExport.ts new file mode 100644 index 0000000..ecac68a --- /dev/null +++ b/src/services/navigationExport.ts @@ -0,0 +1,155 @@ +// Navigation export — turn an optimized groomer route into a deep-link URL that +// opens the device's native navigation app (Google Maps / Apple Maps). +// +// A route is exported as: origin = first stop, destination = last stop, with the +// in-between stops carried as ordered intermediate waypoints. Each platform caps +// how many intermediate waypoints a deep link may carry, so callers must validate +// the route length before handing the URL to the client. + +/** + * Max intermediate waypoints a Google Maps URLs API deep link supports + * (`https://www.google.com/maps/dir/?api=1&...&waypoints=...`). Google documents + * a ceiling of 9 waypoints between origin and destination. + */ +export const GOOGLE_MAPS_MAX_WAYPOINTS = 9; + +/** + * Max intermediate waypoints we allow in an Apple Maps `maps://` deep link. Apple's + * URL scheme chains destinations with `+to:` but does not publish a hard cap; 15 is + * a conservative practical limit that keeps the URL well under length limits. + */ +export const APPLE_MAPS_MAX_WAYPOINTS = 15; + +export type NavigationPlatform = "google-maps" | "apple-maps"; + +/** A single ordered point on the route. `label` is optional, for display only. */ +export interface NavigationStop { + latitude: number; + longitude: number; + label?: string | null; +} + +export interface NavigationExportSuccess { + platform: NavigationPlatform; + url: string; + /** Total stops included (origin + waypoints + destination). */ + stopCount: number; + /** Intermediate waypoints only (excludes origin and destination). */ + waypointCount: number; +} + +export interface NavigationExportError { + error: string; + status: 400; +} + +export type NavigationExportResult = + | NavigationExportSuccess + | NavigationExportError; + +function isError(r: NavigationExportResult): r is NavigationExportError { + return "error" in r; +} + +/** Intermediate waypoints = every stop that is neither origin nor destination. */ +export function intermediateWaypointCount(stopCount: number): number { + return Math.max(0, stopCount - 2); +} + +function coord(stop: NavigationStop): string { + return `${stop.latitude},${stop.longitude}`; +} + +/** + * Builds a Google Maps URLs API driving deep link. On mobile this opens the + * native Google Maps app; on desktop it opens maps.google.com. + */ +export function buildGoogleMapsUrl( + stops: NavigationStop[] +): NavigationExportResult { + if (stops.length === 0) { + return { error: "route has no stops to export", status: 400 }; + } + const waypointCount = intermediateWaypointCount(stops.length); + if (waypointCount > GOOGLE_MAPS_MAX_WAYPOINTS) { + return { + error: `route has ${waypointCount} intermediate waypoints, exceeding Google Maps' limit of ${GOOGLE_MAPS_MAX_WAYPOINTS}`, + status: 400, + }; + } + + const origin = stops[0]!; + const destination = stops[stops.length - 1]!; + const params = new URLSearchParams(); + params.set("api", "1"); + params.set("travelmode", "driving"); + params.set("origin", coord(origin)); + params.set("destination", coord(destination)); + if (stops.length > 2) { + const mids = stops + .slice(1, -1) + .map(coord) + .join("|"); + params.set("waypoints", mids); + } + + return { + platform: "google-maps", + url: `https://www.google.com/maps/dir/?${params.toString()}`, + stopCount: stops.length, + waypointCount, + }; +} + +/** + * Builds an Apple Maps `maps://` driving deep link. The first stop is the source + * (`saddr`); the remaining stops are chained as destinations with `+to:` (`daddr`). + * Built by hand because the `+to:` separators are part of Apple's scheme and must + * not be percent-encoded. + */ +export function buildAppleMapsUrl( + stops: NavigationStop[] +): NavigationExportResult { + if (stops.length === 0) { + return { error: "route has no stops to export", status: 400 }; + } + const waypointCount = intermediateWaypointCount(stops.length); + if (waypointCount > APPLE_MAPS_MAX_WAYPOINTS) { + return { + error: `route has ${waypointCount} intermediate waypoints, exceeding Apple Maps' limit of ${APPLE_MAPS_MAX_WAYPOINTS}`, + status: 400, + }; + } + + const params: string[] = ["dirflg=d"]; + if (stops.length === 1) { + // Single stop: destination only, no source. + params.unshift(`daddr=${coord(stops[0]!)}`); + } else { + const daddr = stops + .slice(1) + .map(coord) + .join("+to:"); + params.unshift(`daddr=${daddr}`); + params.unshift(`saddr=${coord(stops[0]!)}`); + } + + return { + platform: "apple-maps", + url: `maps://?${params.join("&")}`, + stopCount: stops.length, + waypointCount, + }; +} + +/** Dispatches to the correct builder for the requested platform. */ +export function buildNavigationUrl( + platform: NavigationPlatform, + stops: NavigationStop[] +): NavigationExportResult { + return platform === "google-maps" + ? buildGoogleMapsUrl(stops) + : buildAppleMapsUrl(stops); +} + +export { isError as isNavigationExportError }; From 2b92c2ab6cc24ab527e751047670e273bf4d32d3 Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Tue, 9 Jun 2026 07:38:02 +0000 Subject: [PATCH 05/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2294=20R?= =?UTF-8?q?oute=20Optimization=20security=20hardening=20(frozen=20@2566fb8?= =?UTF-8?q?)=20(#197)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit feat(security): GRO-2294 Route Optimization security hardening [squash] Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- UAT_PLAYBOOK.md | 3 +- src/__tests__/geocodeBatchLimit.test.ts | 89 ++++++++++++++++++++++++ src/__tests__/settings.test.ts | 91 +++++++++++++++++++++++++ src/routes/clients.ts | 11 ++- src/routes/settings.ts | 16 ++++- 5 files changed, 206 insertions(+), 4 deletions(-) create mode 100644 src/__tests__/geocodeBatchLimit.test.ts create mode 100644 src/__tests__/settings.test.ts diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index 78b73f3..48082de 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -133,6 +133,7 @@ Geocoding turns a client's street address into `latitude`/`longitude` + `geocode | TC-API-2.11 | Geocode endpoint is manager-only | As **groomer** or **receptionist**, `POST /api/clients/{id}/geocode` | 403 Forbidden (role not permitted) | | TC-API-2.12 | Batch geocode un-geocoded clients | As manager, `POST /api/clients/geocode-batch?limit=10` on a DB with un-geocoded clients | 200 OK; body `{ provider, processed, geocoded, unresolved, errors, remaining, outcomes[] }`. `processed` ≤ 10; `remaining` reflects un-geocoded clients beyond this batch. Re-run while `remaining > 0` to finish (throttled to provider rate limit) | | TC-API-2.13 | Batch geocode — invalid limit | As manager, `POST /api/clients/geocode-batch?limit=0` (or non-numeric) | 400 `{ error: "limit must be a positive integer" }` | +| TC-API-2.13a | Batch geocode — `?limit` cap enforced (GRO-2294) | As manager, `POST /api/clients/geocode-batch?limit=100000` on a DB with un-geocoded clients | 200 OK; the request is **clamped to the documented max of 500** — `processed` ≤ 500 (never the raw 100000). A fractional `?limit` (e.g. `49.9`) is floored to `49`. Confirms a manager cannot hold one synchronous request open / accrue unbounded Google API cost via an oversized limit | | TC-API-2.14 | Batch geocode — manager-only | As groomer/receptionist, `POST /api/clients/geocode-batch` | 403 Forbidden | | TC-API-2.15 | Auto-geocode on create | As manager/receptionist, `POST /api/clients` with a valid `address` | 201 Created; response includes a `geocoding` object (`status: "geocoded"` for a resolvable address) and the persisted client carries `latitude`/`longitude`/`geocodedAt`. Creating without an address succeeds with no `geocoding` field | | TC-API-2.16 | Auto-geocode on address update | As manager/receptionist, `PATCH /api/clients/{id}` changing `address` to a new valid value | 200 OK; response includes a `geocoding` object and refreshed coordinates. Patching unrelated fields (e.g. `name`) does NOT re-geocode (no `geocoding` field) | @@ -331,7 +332,7 @@ This means: | # | Scenario | Steps | Expected | |---|----------|-------|----------| -| TC-API-13.1 | Get business settings | GET /api/admin/settings | 200 OK, business settings returned | +| TC-API-13.1 | Get business settings | GET /api/admin/settings | 200 OK, business settings returned. Response body **must NOT include `googleMapsApiKey`** — the encrypted secret is redacted from the projection (GRO-2294, defense-in-depth); non-secret fields (`businessName`, colors, `routeOptimizationProvider`, etc.) are still present | | TC-API-13.2 | Update business settings | PATCH /api/admin/settings with updated values | 200 OK, settings updated | | TC-API-13.3 | Upload logo | POST /api/admin/settings/logo/upload with file | 200 OK, logo uploaded and stored | | TC-API-13.4 | View logo | GET /api/admin/settings/logo | 200 OK, logo image returned | diff --git a/src/__tests__/geocodeBatchLimit.test.ts b/src/__tests__/geocodeBatchLimit.test.ts new file mode 100644 index 0000000..8731c02 --- /dev/null +++ b/src/__tests__/geocodeBatchLimit.test.ts @@ -0,0 +1,89 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { Hono } from "hono"; + +// ─── Mocks ────────────────────────────────────────────────────────────────── +// GRO-2294: the POST /clients/geocode-batch handler must clamp ?limit to the +// documented maximum (500) before invoking the geocoding service. We mock the +// service to capture the exact limit the route forwards. + +const geocodeUngeocodedClients = vi.fn(async () => ({ + totalRemaining: 0, + processed: 0, + geocoded: 0, + failed: 0, + remaining: 0, +})); + +vi.mock("../services/clientGeocoding.js", () => ({ + geocodeUngeocodedClients, + geocodeClient: vi.fn(), + resolveClientGeocodingProvider: vi.fn(), +})); + +vi.mock("@groombook/db", () => { + const tableProxy = (name: string) => + new Proxy( + { _name: name }, + { get: (_t, p) => (p === "_name" ? name : { table: name, column: p }) } + ); + return { + getDb: () => ({}), + clients: tableProxy("clients"), + appointments: tableProxy("appointments"), + and: vi.fn(), + eq: vi.fn(), + or: vi.fn(), + exists: vi.fn(), + }; +}); + +const { clientsRouter } = await import("../routes/clients.js"); + +const app = new Hono(); +app.route("/clients", clientsRouter); + +function postBatch(query: string) { + return app.request(`/clients/geocode-batch${query}`, { method: "POST" }); +} + +describe("POST /clients/geocode-batch — ?limit cap (GRO-2294)", () => { + beforeEach(() => { + geocodeUngeocodedClients.mockClear(); + }); + + it("defaults to 50 when no ?limit is supplied", async () => { + const res = await postBatch(""); + expect(res.status).toBe(200); + expect(geocodeUngeocodedClients).toHaveBeenCalledWith(expect.anything(), 50); + }); + + it("passes through a value within the cap", async () => { + const res = await postBatch("?limit=120"); + expect(res.status).toBe(200); + expect(geocodeUngeocodedClients).toHaveBeenCalledWith(expect.anything(), 120); + }); + + it("clamps an over-cap value to 500", async () => { + const res = await postBatch("?limit=100000"); + expect(res.status).toBe(200); + expect(geocodeUngeocodedClients).toHaveBeenCalledWith(expect.anything(), 500); + }); + + it("floors a fractional value before clamping", async () => { + const res = await postBatch("?limit=49.9"); + expect(res.status).toBe(200); + expect(geocodeUngeocodedClients).toHaveBeenCalledWith(expect.anything(), 49); + }); + + it("rejects a non-positive limit with 400", async () => { + const res = await postBatch("?limit=0"); + expect(res.status).toBe(400); + expect(geocodeUngeocodedClients).not.toHaveBeenCalled(); + }); + + it("rejects a non-numeric limit with 400", async () => { + const res = await postBatch("?limit=abc"); + expect(res.status).toBe(400); + expect(geocodeUngeocodedClients).not.toHaveBeenCalled(); + }); +}); diff --git a/src/__tests__/settings.test.ts b/src/__tests__/settings.test.ts new file mode 100644 index 0000000..c878999 --- /dev/null +++ b/src/__tests__/settings.test.ts @@ -0,0 +1,91 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { Hono } from "hono"; + +// ─── Mocks ────────────────────────────────────────────────────────────────── +// GRO-2294: GET /api/admin/settings must not return the encrypted +// googleMapsApiKey ciphertext, on either the existing-row or auto-create branch. + +let selectRows: Record[] = []; +let insertReturning: Record[] = []; + +function makeChainable(data: unknown[]): unknown { + const arr = [...data]; + const chain = new Proxy(arr, { + get(target, prop) { + if (prop === "where" || prop === "orderBy" || prop === "limit") { + return () => chain; + } + // @ts-expect-error proxy passthrough + return target[prop]; + }, + }); + return chain; +} + +vi.mock("@groombook/db", () => { + const businessSettings = new Proxy( + { _name: "business_settings" }, + { get: (_t, p) => (p === "_name" ? "business_settings" : { column: p }) } + ); + return { + getDb: () => ({ + select: () => ({ from: () => makeChainable(selectRows) }), + insert: () => ({ + values: () => ({ returning: () => insertReturning }), + }), + }), + businessSettings, + eq: vi.fn(), + }; +}); + +vi.mock("../lib/s3.js", () => ({ + getPresignedUploadUrl: vi.fn(), + deleteObject: vi.fn(), + putObject: vi.fn(), + getObject: vi.fn(), +})); + +const { settingsRouter } = await import("../routes/settings.js"); + +const app = new Hono(); +app.route("/settings", settingsRouter); + +const FULL_ROW = { + id: "settings-uuid-1", + businessName: "GroomBook", + primaryColor: "#4f8a6f", + accentColor: "#8b7355", + routeOptimizationProvider: "google", + googleMapsApiKey: "ENCRYPTED::super-secret-ciphertext", + createdAt: new Date(), + updatedAt: new Date(), +}; + +describe("GET /settings — googleMapsApiKey redaction (GRO-2294)", () => { + beforeEach(() => { + selectRows = []; + insertReturning = []; + }); + + it("omits googleMapsApiKey from an existing settings row", async () => { + selectRows = [{ ...FULL_ROW }]; + const res = await app.request("/settings", { method: "GET" }); + expect(res.status).toBe(200); + const body = (await res.json()) as Record; + expect(body).not.toHaveProperty("googleMapsApiKey"); + // Non-secret fields are still returned. + expect(body.businessName).toBe("GroomBook"); + expect(body.routeOptimizationProvider).toBe("google"); + }); + + it("omits googleMapsApiKey from the auto-create branch", async () => { + selectRows = []; + insertReturning = [{ ...FULL_ROW, id: "settings-uuid-new" }]; + const res = await app.request("/settings", { method: "GET" }); + expect(res.status).toBe(200); + const body = (await res.json()) as Record; + expect(body).not.toHaveProperty("googleMapsApiKey"); + expect(body.id).toBe("settings-uuid-new"); + }); +}); diff --git a/src/routes/clients.ts b/src/routes/clients.ts index e7ac65c..328ed31 100644 --- a/src/routes/clients.ts +++ b/src/routes/clients.ts @@ -12,6 +12,12 @@ import { export const clientsRouter = new Hono(); +// Batch-geocode bounds (GRO-2294): default 50, hard cap 500. The cap bounds how +// long one synchronous request stays open and the per-request external API cost +// when routeOptimizationProvider = "google". +const GEOCODE_BATCH_DEFAULT_LIMIT = 50; +const GEOCODE_BATCH_MAX_LIMIT = 500; + type ClientRow = typeof clients.$inferSelect; /** @@ -185,12 +191,15 @@ clientsRouter.post("/:clientId/geocode", async (c) => { clientsRouter.post("/geocode-batch", async (c) => { const db = getDb(); const limitRaw = c.req.query("limit"); - let limit = 50; + let limit = GEOCODE_BATCH_DEFAULT_LIMIT; if (limitRaw !== undefined) { limit = Number(limitRaw); if (!Number.isFinite(limit) || limit <= 0) { return c.json({ error: "limit must be a positive integer" }, 400); } + // Clamp to the documented maximum to bound synchronous request duration + // and (for the Google provider) per-request external API cost. + limit = Math.min(Math.floor(limit), GEOCODE_BATCH_MAX_LIMIT); } const summary = await geocodeUngeocodedClients(db, limit); return c.json(summary); diff --git a/src/routes/settings.ts b/src/routes/settings.ts index 3b931db..8529135 100644 --- a/src/routes/settings.ts +++ b/src/routes/settings.ts @@ -7,6 +7,17 @@ import { requireSuperUser } from "../middleware/rbac.js"; export const settingsRouter = new Hono(); +type BusinessSettingsRow = typeof businessSettings.$inferSelect; + +// Strip the encrypted googleMapsApiKey ciphertext from settings responses +// (GRO-2294, defense-in-depth). The secret is never needed client-side; it is +// only written via the dedicated provider-config endpoint. +function redactSettings(row: BusinessSettingsRow) { + const rest: Partial = { ...row }; + delete rest.googleMapsApiKey; + return rest; +} + // GET /api/admin/settings — return current business settings settingsRouter.get("/", async (c) => { const db = getDb(); @@ -14,9 +25,10 @@ settingsRouter.get("/", async (c) => { if (!row) { // Auto-create default settings if none exist const [created] = await db.insert(businessSettings).values({}).returning(); - return c.json(created); + if (!created) throw new Error("Failed to create default settings"); + return c.json(redactSettings(created)); } - return c.json(row); + return c.json(redactSettings(row)); }); const hexColorRegex = /^#[0-9a-fA-F]{6}$/; From 03f79a370135d4590ee9ab4846deea382fd14cdd Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Tue, 9 Jun 2026 07:49:49 +0000 Subject: [PATCH 06/14] =?UTF-8?q?uat=20=E2=86=92=20main:=20GRO-2299=20reda?= =?UTF-8?q?ct=20googleMapsApiKey=20from=20PATCH=20/api/admin/settings=20(#?= =?UTF-8?q?198)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GRO-2299: redact googleMapsApiKey from PATCH /api/admin/settings response Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- UAT_PLAYBOOK.md | 2 +- src/__tests__/settings.test.ts | 54 ++++++++++++++++++++++++++++++++++ src/routes/settings.ts | 3 +- 3 files changed, 57 insertions(+), 2 deletions(-) diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index 48082de..ecccc77 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -333,7 +333,7 @@ This means: | # | Scenario | Steps | Expected | |---|----------|-------|----------| | TC-API-13.1 | Get business settings | GET /api/admin/settings | 200 OK, business settings returned. Response body **must NOT include `googleMapsApiKey`** — the encrypted secret is redacted from the projection (GRO-2294, defense-in-depth); non-secret fields (`businessName`, colors, `routeOptimizationProvider`, etc.) are still present | -| TC-API-13.2 | Update business settings | PATCH /api/admin/settings with updated values | 200 OK, settings updated | +| TC-API-13.2 | Update business settings | PATCH /api/admin/settings with updated values | 200 OK, settings updated. Response body **must NOT include `googleMapsApiKey`** — the encrypted secret is redacted from the PATCH response symmetrically with the GET projection (GRO-2299, defense-in-depth); non-secret updated fields are still returned | | TC-API-13.3 | Upload logo | POST /api/admin/settings/logo/upload with file | 200 OK, logo uploaded and stored | | TC-API-13.4 | View logo | GET /api/admin/settings/logo | 200 OK, logo image returned | | TC-API-13.5 | Delete logo | DELETE /api/admin/settings/logo | 200 OK, logo removed | diff --git a/src/__tests__/settings.test.ts b/src/__tests__/settings.test.ts index c878999..5cdccca 100644 --- a/src/__tests__/settings.test.ts +++ b/src/__tests__/settings.test.ts @@ -7,6 +7,7 @@ import { Hono } from "hono"; let selectRows: Record[] = []; let insertReturning: Record[] = []; +let updateReturning: Record[] = []; function makeChainable(data: unknown[]): unknown { const arr = [...data]; @@ -33,6 +34,9 @@ vi.mock("@groombook/db", () => { insert: () => ({ values: () => ({ returning: () => insertReturning }), }), + update: () => ({ + set: () => ({ where: () => ({ returning: () => updateReturning }) }), + }), }), businessSettings, eq: vi.fn(), @@ -51,6 +55,17 @@ const { settingsRouter } = await import("../routes/settings.js"); const app = new Hono(); app.route("/settings", settingsRouter); +// PATCH /settings is guarded by requireSuperUser(), which reads the staff record +// from context. Inject a super-user staff row so the handler runs. +const patchApp = new Hono<{ + Variables: { staff: { id: string; isSuperUser: boolean } }; +}>(); +patchApp.use("*", async (c, next) => { + c.set("staff", { id: "staff-1", isSuperUser: true }); + await next(); +}); +patchApp.route("/settings", settingsRouter); + const FULL_ROW = { id: "settings-uuid-1", businessName: "GroomBook", @@ -89,3 +104,42 @@ describe("GET /settings — googleMapsApiKey redaction (GRO-2294)", () => { expect(body.id).toBe("settings-uuid-new"); }); }); + +describe("PATCH /settings — googleMapsApiKey redaction (GRO-2299)", () => { + beforeEach(() => { + selectRows = []; + insertReturning = []; + updateReturning = []; + }); + + function patchRequest(body: Record) { + return patchApp.request("/settings", { + method: "PATCH", + headers: { "content-type": "application/json" }, + body: JSON.stringify(body), + }); + } + + it("omits googleMapsApiKey from the PATCH response", async () => { + selectRows = [{ ...FULL_ROW }]; + updateReturning = [{ ...FULL_ROW, businessName: "Updated Name" }]; + const res = await patchRequest({ businessName: "Updated Name" }); + expect(res.status).toBe(200); + const body = (await res.json()) as Record; + expect(body).not.toHaveProperty("googleMapsApiKey"); + // Non-secret updated fields are still returned. + expect(body.businessName).toBe("Updated Name"); + expect(body.routeOptimizationProvider).toBe("google"); + }); + + it("omits googleMapsApiKey on the auto-create-then-update branch", async () => { + selectRows = []; + insertReturning = [{ ...FULL_ROW, id: "settings-uuid-new" }]; + updateReturning = [{ ...FULL_ROW, id: "settings-uuid-new" }]; + const res = await patchRequest({ primaryColor: "#123456" }); + expect(res.status).toBe(200); + const body = (await res.json()) as Record; + expect(body).not.toHaveProperty("googleMapsApiKey"); + expect(body.id).toBe("settings-uuid-new"); + }); +}); diff --git a/src/routes/settings.ts b/src/routes/settings.ts index 8529135..bcb4476 100644 --- a/src/routes/settings.ts +++ b/src/routes/settings.ts @@ -65,7 +65,8 @@ settingsRouter.patch( .where(eq(businessSettings.id, settingsId)) .returning(); - return c.json(updated); + if (!updated) throw new Error("Failed to update settings"); + return c.json(redactSettings(updated)); } ); From 4bbb0c9fc5cbdef04d043113d8a98bd0e21a0f21 Mon Sep 17 00:00:00 2001 From: Flea Flicker Date: Tue, 9 Jun 2026 10:19:25 +0000 Subject: [PATCH 07/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2172=20p?= =?UTF-8?q?et=20extended-field=20schema=20fix=20(frozen=20@c4385617)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Promote GRO-2172 from uat to main. Pins src/routes/pets.ts to its exact content at uat merge commit c4385617 (PR #200), adding the extended pet profile fields to createPetSchema/updatePetSchema and wiring medicalAlerts into POST/PATCH /pets: - temperamentScore: int 1–5 - temperamentFlags: string[] (≤20, each ≤100 chars) - medicalAlerts: {type,description,severity}[] (≤50) - preferredCuts: string[] (≤20, each ≤200 chars) - coatType already present on main; schema now references all 5 fields Based on main HEAD (03f79a37) so the PR diff is limited to src/routes/pets.ts. GRO-2311 (uat HEAD 807ccb45) is intentionally excluded. Co-Authored-By: Paperclip --- src/routes/pets.ts | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/src/routes/pets.ts b/src/routes/pets.ts index 5c4aaec..229a047 100644 --- a/src/routes/pets.ts +++ b/src/routes/pets.ts @@ -57,6 +57,23 @@ const createPetSchema = z.object({ customFields: z.record(z.string(), z.string()).optional(), petSizeCategory: z.enum(["small", "medium", "large", "extra_large"]).optional(), coatType: z.enum(["short", "medium", "long", "double", "wire", "silky", "curly", "hairless"]).optional(), + // Extended pet profile fields (api/#39, GRO-1178). + // GRO-2172: these were missing from the schema, causing POST/PATCH to + // silently drop them even though migrations 0034/0036 and seed data + // populate them. GRO-1472 was the original UAT regression. + temperamentScore: z.number().int().min(1).max(5).optional(), + temperamentFlags: z.array(z.string().max(100)).max(20).optional(), + medicalAlerts: z + .array( + z.object({ + type: z.string().max(100), + description: z.string().max(1000), + severity: z.enum(["low", "medium", "high"]), + }) + ) + .max(50) + .optional(), + preferredCuts: z.array(z.string().max(200)).max(20).optional(), }); const updatePetSchema = createPetSchema.partial().omit({ clientId: true }); @@ -333,7 +350,8 @@ petsRouter.get("/:id/profile-summary", async (c) => { petsRouter.post("/", zValidator("json", createPetSchema), async (c) => { const db = getDb(); - const { weightKg, dateOfBirth, customFields, ...rest } = c.req.valid("json"); + const { weightKg, dateOfBirth, customFields, medicalAlerts, ...rest } = + c.req.valid("json"); const [row] = await db .insert(pets) .values({ @@ -341,6 +359,10 @@ petsRouter.post("/", zValidator("json", createPetSchema), async (c) => { weightKg: weightKg?.toString(), dateOfBirth: dateOfBirth ? new Date(dateOfBirth) : undefined, customFields: customFields ?? {}, + // GRO-2172: medicalAlerts shape from the API request is + // { type, description, severity } — the @groombook/types MedicalAlert + // has an optional server-generated `id`, so cast for the jsonb column. + medicalAlerts: medicalAlerts as never, }) .returning(); return c.json(row, 201); @@ -351,7 +373,8 @@ petsRouter.patch( zValidator("json", updatePetSchema), async (c) => { const db = getDb(); - const { weightKg, dateOfBirth, customFields, ...rest } = c.req.valid("json"); + const { weightKg, dateOfBirth, customFields, medicalAlerts, ...rest } = + c.req.valid("json"); const [row] = await db .update(pets) .set({ @@ -359,6 +382,7 @@ petsRouter.patch( weightKg: weightKg?.toString(), dateOfBirth: dateOfBirth ? new Date(dateOfBirth) : undefined, ...(customFields !== undefined ? { customFields } : {}), + medicalAlerts: medicalAlerts as never, updatedAt: new Date(), }) .where(eq(pets.id, c.req.param("id"))) From 31404befeee6719156cec3c237f56fda6285a565 Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Tue, 9 Jun 2026 11:18:03 +0000 Subject: [PATCH 08/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2311=20s?= =?UTF-8?q?eed=20portal=20StatusBadge=20appointments=20(frozen=20@df5e768)?= =?UTF-8?q?=20(#206)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit uat→main (PROD): GRO-2311 seed portal StatusBadge appointments (squash) Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- packages/db/src/seed.ts | 170 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 170 insertions(+) diff --git a/packages/db/src/seed.ts b/packages/db/src/seed.ts index 55b2ee4..24d3dc3 100644 --- a/packages/db/src/seed.ts +++ b/packages/db/src/seed.ts @@ -830,6 +830,168 @@ async function seedUatGroomerLinkage( ); } +// ── GRO-2311 / GRO-2313: portal customer StatusBadge coverage ──────────────── + +/** + * GRO-2311 / GRO-2313: give the UAT portal customer (`uat-customer@groombook.dev`) + * a deterministic spread of appointments so the customer-portal StatusBadge + * palette can be LIVE-observed (not just code-verified against the bundle). + * + * Scope is the subset of badge states reachable from the `appointment_status` + * enum (`scheduled, confirmed, in_progress, completed, cancelled, no_show`) — + * the portal's renders `appointment.status` verbatim. `pending` + * and `waitlisted` are NOT valid appointment statuses and cannot be seeded; the + * styled `no_show`→`no-show` badge fix and any pending/waitlisted derivation are + * tracked separately in GRO-2319 (web). CTO-approved Option A on GRO-2313. + * + * - confirmed → future startTime → renders as an Upcoming card (Confirmed badge) + * - scheduled → future startTime → renders as an Upcoming card (Scheduled badge) + * - cancelled → past startTime → Past tab (isUpcoming excludes cancelled) + * - no_show → past startTime → Past tab (raw `no_show` label until GRO-2319) + * + * The existing GRO-2100 `completed` appointment (a0000001-…-0001) is left + * untouched (AC #4), so Completed is also covered. + * + * Idempotent: each appointment uses a fixed UUID and is upserted with + * onConflictDoNothing, so the hourly reset-demo-data CronJob (which TRUNCATEs + * then re-seeds) and non-truncating dev re-seeds never dup-key + * (see GRO-2033 for the dup-key class). + */ +async function seedUatCustomerPortalAppointments( + db: ReturnType, + customerClientId: string | null, +): Promise { + const LINKED_PET_ID = "c0000001-0000-0000-0000-000000000002"; // UAT Pup Alpha + + // Skip silently outside the UAT persona profile (e.g. a dev/test seed that + // never created the UAT Customer client). + if (!customerClientId) { + return; + } + + // The customer's pet must exist (pets are NOT truncated on reset, so this is + // stable). Defensive: bail cleanly if the persona pet is absent. + const [linkedPet] = await db + .select({ id: schema.pets.id }) + .from(schema.pets) + .where(eq(schema.pets.id, LINKED_PET_ID)) + .limit(1); + if (!linkedPet) { + console.warn(`⚠ GRO-2311: UAT Pup Alpha (${LINKED_PET_ID}) not found — skipping portal appointment seed`); + return; + } + + // Stable "Bath & Brush" service; fall back to any active service. + const BATH_AND_BRUSH_ID = "b0000001-0000-0000-0000-000000000001"; + const [bathService] = await db + .select({ id: schema.services.id }) + .from(schema.services) + .where(eq(schema.services.id, BATH_AND_BRUSH_ID)) + .limit(1); + + let serviceId: string; + if (bathService) { + serviceId = bathService.id; + } else { + const [fallback] = await db + .select({ id: schema.services.id }) + .from(schema.services) + .where(eq(schema.services.active, true)) + .limit(1); + if (!fallback) { + console.warn(`⚠ GRO-2311: no active services found — skipping portal appointment seed`); + return; + } + serviceId = fallback.id; + } + + // Attach the UAT groomer when present (nicer "with " card); else null + // ("First Available"). Either way these are the customer's own appointments — + // no new groomer↔pet linkage invariant is created (uses the already-linked + // Pup Alpha), so GRO-1987 TC-UAT-3 (403 on the UNLINKED Pup Beta) is unaffected. + const [uatGroomerStaff] = await db + .select({ id: schema.staff.id }) + .from(schema.staff) + .where(eq(schema.staff.email, "uat-groomer@groombook.dev")) + .limit(1); + const staffId = uatGroomerStaff?.id ?? null; + + // Anchor all times to local wall-clock so future/past holds regardless of the + // hourly reset cadence. + const at = (deltaDays: number, hour: number): Date => { + const d = new Date(); + d.setDate(d.getDate() + deltaDays); + d.setHours(hour, 0, 0, 0); + return d; + }; + const DURATION_MS = 45 * 60 * 1000; + + const rows = [ + { + id: "a0000001-0000-0000-0000-000000000002", + status: "confirmed" as const, + start: at(3, 10), + confirmationStatus: "confirmed", + confirmedAt: new Date(), + cancelledAt: null as Date | null, + notes: "GRO-2311: upcoming confirmed appointment for portal StatusBadge coverage.", + }, + { + id: "a0000001-0000-0000-0000-000000000003", + status: "scheduled" as const, + start: at(5, 14), + confirmationStatus: "pending", + confirmedAt: null as Date | null, + cancelledAt: null as Date | null, + notes: "GRO-2311: upcoming scheduled appointment for portal StatusBadge coverage.", + }, + { + id: "a0000001-0000-0000-0000-000000000004", + status: "cancelled" as const, + start: at(-3, 11), + confirmationStatus: "cancelled", + confirmedAt: null as Date | null, + cancelledAt: new Date(), + notes: "GRO-2311: cancelled appointment (Past tab) for portal StatusBadge coverage.", + }, + { + id: "a0000001-0000-0000-0000-000000000005", + status: "no_show" as const, + start: at(-10, 9), + confirmationStatus: "confirmed", + confirmedAt: null as Date | null, + cancelledAt: null as Date | null, + notes: "GRO-2311: no_show appointment (Past tab) for portal StatusBadge coverage.", + }, + ]; + + await db + .insert(schema.appointments) + .values( + rows.map((r) => ({ + id: r.id, + clientId: customerClientId, + petId: LINKED_PET_ID, + serviceId, + staffId, + batherStaffId: null, + status: r.status, + startTime: r.start, + endTime: new Date(r.start.getTime() + DURATION_MS), + notes: r.notes, + priceCents: null, + confirmationStatus: r.confirmationStatus, + confirmedAt: r.confirmedAt, + cancelledAt: r.cancelledAt, + })), + ) + .onConflictDoNothing({ target: schema.appointments.id }); + + console.log( + `✓ GRO-2311: seeded ${rows.length} portal StatusBadge appointments (confirmed/scheduled/cancelled/no_show) for UAT customer`, + ); +} + // ── GRO-2225: deterministic route-optimization cohort ──────────────────────── /** @@ -1111,6 +1273,10 @@ async function seedKnownUsers() { // to attach to the appointment; on a fresh reset there are none yet at // the time seedUatStaffAccounts() returns). await seedUatGroomerLinkage(db, uatCustomerClientId); + // GRO-2311 / GRO-2313: portal customer StatusBadge palette coverage (reachable + // appointment statuses only). Runs after the groomer linkage so the customer + // client + Pup Alpha already exist. + await seedUatCustomerPortalAppointments(db, uatCustomerClientId); // ── Client: Demo Client ── const [existingClient] = await db @@ -1373,6 +1539,10 @@ async function runSeedBody( // to attach to the appointment; on a fresh reset there are none yet at // the time seedUatStaffAccounts() returns). await seedUatGroomerLinkage(db, uatCustomerClientId); + // GRO-2311 / GRO-2313: portal customer StatusBadge palette coverage (reachable + // appointment statuses only). Runs after the groomer linkage so the customer + // client + Pup Alpha already exist. + await seedUatCustomerPortalAppointments(db, uatCustomerClientId); // GRO-2225: deterministic pre-geocoded route cohort + fixed-date appointments // for the UAT groomer. Must run AFTER services are seeded (it looks up a From 47e2021cf45bc7d494d1b32785437a69eb8e0a4f Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Wed, 10 Jun 2026 08:58:26 +0000 Subject: [PATCH 09/14] =?UTF-8?q?Promote=20uat=20=E2=86=92=20main=20(PROD)?= =?UTF-8?q?:=20GRO-2319=20portal=20waitlist=20surfacing=20+=20seed=20(#207?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- UAT_PLAYBOOK.md | 1 + packages/db/src/seed.ts | 52 ++++++++++++++++++++++--- src/__tests__/portal.test.ts | 73 ++++++++++++++++++++++++++++++++++++ src/routes/portal.ts | 48 ++++++++++++++++++++++-- 4 files changed, 165 insertions(+), 9 deletions(-) diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index ecccc77..71d00ff 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -287,6 +287,7 @@ This means: | TC-API-8.16 | Portal pet update — malformed (non-UUID) petId returns 404 (GRO-2203) | With a valid portal session, `PATCH /api/portal/pets/not-a-uuid` with header `X-Impersonation-Session-Id` and body `{"coatType":"short"}` | 404 Not Found with body `{"error":"Not found"}` (was an unhandled 500 from the Postgres uuid cast in GRO-2203; mirrors the GRO-2014 guard). No mutation persisted | | TC-API-8.17 | SSO portal session slides on activity (GRO-2234) | Establish a portal session (TC-API-8.8). Note the returned `sessionId`. Make any authenticated portal call (e.g. `GET /api/portal/me`) several times spaced over ≥1 minute, each with `X-Impersonation-Session-Id: {sessionId}`. | Every call returns 200; the session's `expiresAt` is extended (slid forward to ~30 min from each request) so the session stays valid during continuous use — it does NOT lapse mid-session. SSO-bridge sessions mint with a 30-min idle TTL bounded by an 8h absolute cap from `startedAt`. | | TC-API-8.18 | Slow-wizard Book New submit succeeds (GRO-2234) | Establish a portal session (TC-API-8.8). Wait >2 minutes while making at least one intervening authenticated portal call (mimicking the multi-step Book New wizard: pet/service/groomer/date GETs). Then `POST /api/portal/waitlist` with a valid pet+service payload and the same `X-Impersonation-Session-Id`. | 201 Created — the deliberately-paced wizard no longer 401s on submit because activity slid the session forward. (Regression guard for the GRO-2234 "session TTL too short → 401" defect.) | +| TC-API-8.19 | Portal appointments surface active waitlist entries (GRO-2319) | As `uat-customer@groombook.dev`, establish a portal session, then `GET /api/portal/appointments`. | 200 OK. In addition to the customer's appointments, the response includes the seeded ACTIVE waitlist entry as a synthetic card: `status: "waitlisted"`, `id` prefixed `waitlist:`, `confirmationStatus: null`, a non-null derived `startTime` (from the entry's preferred date/time), and the entry's `pet`. Cancelled/notified/expired waitlist entries are NOT surfaced. | ### 4.9 Waitlist diff --git a/packages/db/src/seed.ts b/packages/db/src/seed.ts index 24d3dc3..6ca4cc0 100644 --- a/packages/db/src/seed.ts +++ b/packages/db/src/seed.ts @@ -837,12 +837,14 @@ async function seedUatGroomerLinkage( * a deterministic spread of appointments so the customer-portal StatusBadge * palette can be LIVE-observed (not just code-verified against the bundle). * - * Scope is the subset of badge states reachable from the `appointment_status` - * enum (`scheduled, confirmed, in_progress, completed, cancelled, no_show`) — - * the portal's renders `appointment.status` verbatim. `pending` - * and `waitlisted` are NOT valid appointment statuses and cannot be seeded; the - * styled `no_show`→`no-show` badge fix and any pending/waitlisted derivation are - * tracked separately in GRO-2319 (web). CTO-approved Option A on GRO-2313. + * `appointment_status` enum is (`scheduled, confirmed, in_progress, completed, + * cancelled, no_show`) — the portal's renders `appointment.status` + * verbatim. `pending` and `waitlisted` are NOT valid appointment statuses, so + * GRO-2319 derives them in the portal: `pending` from an upcoming appointment's + * `confirmationStatus` (the `scheduled` row below carries `pending`), and + * `waitlisted` from an ACTIVE `waitlist_entries` row (seeded at the end of this + * function) which `GET /api/portal/appointments` surfaces as a synthetic card. + * The `no_show`→`no-show` badge-key fix is the web side of GRO-2319. * * - confirmed → future startTime → renders as an Upcoming card (Confirmed badge) * - scheduled → future startTime → renders as an Upcoming card (Scheduled badge) @@ -990,6 +992,44 @@ async function seedUatCustomerPortalAppointments( console.log( `✓ GRO-2311: seeded ${rows.length} portal StatusBadge appointments (confirmed/scheduled/cancelled/no_show) for UAT customer`, ); + + // GRO-2319 item 2: seed one ACTIVE waitlist entry so the portal's `waitlisted` + // card (surfaced by GET /api/portal/appointments) is live-observable. Unlike + // appointments, `waitlist_entries` is NOT truncated on the hourly reset, so we + // upsert by fixed id and REFRESH the preferred date to a future-relative value + // each reset — otherwise the date would go stale and the card would drop out of + // the Upcoming list. (The seeded `scheduled` appointment above already carries + // `confirmationStatus: "pending"`, which drives the live Pending badge.) + const WAITLIST_ENTRY_ID = "e0000001-0000-0000-0000-000000000001"; + const pad2 = (n: number): string => String(n).padStart(2, "0"); + const wlStart = at(7, 13); // 7 days out, 1pm — comfortably "upcoming" + const wlPreferredDate = `${wlStart.getFullYear()}-${pad2(wlStart.getMonth() + 1)}-${pad2(wlStart.getDate())}`; + const wlPreferredTime = `${pad2(wlStart.getHours())}:00:00`; + + await db + .insert(schema.waitlistEntries) + .values({ + id: WAITLIST_ENTRY_ID, + clientId: customerClientId, + petId: LINKED_PET_ID, + serviceId, + preferredDate: wlPreferredDate, + preferredTime: wlPreferredTime, + status: "active", + }) + .onConflictDoUpdate({ + target: schema.waitlistEntries.id, + set: { + preferredDate: wlPreferredDate, + preferredTime: wlPreferredTime, + status: "active", + updatedAt: new Date(), + }, + }); + + console.log( + `✓ GRO-2319: seeded 1 active waitlist entry (${wlPreferredDate} ${wlPreferredTime}) for UAT customer portal Waitlisted card`, + ); } // ── GRO-2225: deterministic route-optimization cohort ──────────────────────── diff --git a/src/__tests__/portal.test.ts b/src/__tests__/portal.test.ts index 73f05ff..84f37ab 100644 --- a/src/__tests__/portal.test.ts +++ b/src/__tests__/portal.test.ts @@ -39,11 +39,17 @@ const APPOINTMENT = { let selectSessionRow: Record | null = null; let selectAppointmentRow: Record | null = null; +let selectWaitlistRows: Record[] = []; +let selectPetRows: Record[] = []; +let selectStaffRows: Record[] = []; let updatedValues: Record[] = []; function resetMock() { selectSessionRow = null; selectAppointmentRow = null; + selectWaitlistRows = []; + selectPetRows = []; + selectStaffRows = []; updatedValues = []; } @@ -72,6 +78,12 @@ vi.mock("@groombook/db", () => { { get: (t, p) => (p === "_name" ? "appointments" : { table: "appointments", column: p }) } ); + const mkTable = (name: string) => + new Proxy({ _name: name }, { get: (t, p) => (p === "_name" ? name : { table: name, column: p }) }); + const waitlistEntries = mkTable("waitlistEntries"); + const pets = mkTable("pets"); + const staff = mkTable("staff"); + return { getDb: () => ({ select: () => ({ @@ -82,6 +94,15 @@ vi.mock("@groombook/db", () => { if (table._name === "appointments") { return makeChainable(selectAppointmentRow ? [selectAppointmentRow] : []); } + if (table._name === "waitlistEntries") { + return makeChainable(selectWaitlistRows); + } + if (table._name === "pets") { + return makeChainable(selectPetRows); + } + if (table._name === "staff") { + return makeChainable(selectStaffRows); + } return makeChainable([]); }, }), @@ -102,8 +123,12 @@ vi.mock("@groombook/db", () => { }), impersonationSessions, appointments, + waitlistEntries, + pets, + staff, eq: vi.fn(), and: vi.fn(), + inArray: vi.fn(), }; }); @@ -125,6 +150,54 @@ function jsonPatch(path: string, body: unknown, headers?: Record beforeEach(() => resetMock()); +// GRO-2319 item 2: the portal Upcoming list renders active waitlist entries as +// synthetic `waitlisted` cards, so GET /portal/appointments must surface them. +describe("GET /portal/appointments (waitlist surfacing — GRO-2319)", () => { + it("returns active waitlist entries as synthetic waitlisted cards", async () => { + selectSessionRow = ACTIVE_SESSION; + selectAppointmentRow = { ...APPOINTMENT }; + selectWaitlistRows = [ + { + id: "11111111-1111-1111-1111-111111111111", + petId: "pet-1", + serviceId: "svc-1", + preferredDate: "2099-01-01", + preferredTime: "13:00:00", + }, + ]; + selectPetRows = [{ id: "pet-1", name: "Rex", photoKey: null }]; + + const res = await app.request("/portal/appointments", { + headers: { "X-Impersonation-Session-Id": SESSION_ID }, + }); + expect(res.status).toBe(200); + const body = await res.json(); + const waitlistCard = body.appointments.find( + (a: { status: string }) => a.status === "waitlisted", + ); + expect(waitlistCard).toBeTruthy(); + expect(waitlistCard.id).toBe("waitlist:11111111-1111-1111-1111-111111111111"); + expect(waitlistCard.pet.name).toBe("Rex"); + expect(waitlistCard.confirmationStatus).toBeNull(); + // startTime is derived from preferredDate + preferredTime so the card sorts + // and classifies as Upcoming. + expect(waitlistCard.startTime).toBeTruthy(); + }); + + it("omits the waitlist section when the client has no active entries", async () => { + selectSessionRow = ACTIVE_SESSION; + selectAppointmentRow = { ...APPOINTMENT }; + selectWaitlistRows = []; + + const res = await app.request("/portal/appointments", { + headers: { "X-Impersonation-Session-Id": SESSION_ID }, + }); + expect(res.status).toBe(200); + const body = await res.json(); + expect(body.appointments.some((a: { status: string }) => a.status === "waitlisted")).toBe(false); + }); +}); + describe("PATCH /portal/appointments/:id/notes", () => { it("returns updated appointment with safe fields only", async () => { selectSessionRow = ACTIVE_SESSION; diff --git a/src/routes/portal.ts b/src/routes/portal.ts index 3c7dab9..65c53a7 100644 --- a/src/routes/portal.ts +++ b/src/routes/portal.ts @@ -1,7 +1,7 @@ import { Hono } from "hono"; import { zValidator } from "@hono/zod-validator"; import { z } from "zod/v3"; -import { eq, inArray } from "@groombook/db"; +import { and, eq, inArray } from "@groombook/db"; import { getDb, appointments, impersonationSessions, waitlistEntries, clients, pets, services, staff, invoices, invoiceLineItems } from "@groombook/db"; import { validatePortalSession, PORTAL_SESSION_IDLE_TTL_MS } from "../middleware/portalSession.js"; import { portalAudit } from "../middleware/portalAudit.js"; @@ -195,7 +195,29 @@ portalRouter.get("/appointments", async (c) => { .where(eq(appointments.clientId, clientId)) .orderBy(appointments.startTime); - const petIds = allAppts.map(a => a.petId).filter((id): id is string => id !== null); + // GRO-2319: surface the client's ACTIVE waitlist entries alongside their + // appointments so the portal can render them as `waitlisted` cards in the + // Upcoming list. The `appointment_status` enum cannot represent `waitlisted`, + // so these are synthetic entries (status hard-set to `waitlisted`, id prefixed + // `waitlist:`) derived from `waitlist_entries`. + const waitlistRows = await db + .select({ + id: waitlistEntries.id, + petId: waitlistEntries.petId, + serviceId: waitlistEntries.serviceId, + preferredDate: waitlistEntries.preferredDate, + preferredTime: waitlistEntries.preferredTime, + }) + .from(waitlistEntries) + .where( + and(eq(waitlistEntries.clientId, clientId), eq(waitlistEntries.status, "active")), + ); + + // Pet lookups must cover both appointment and waitlist pets. + const petIds = [ + ...allAppts.map(a => a.petId).filter((id): id is string => id !== null), + ...waitlistRows.map(w => w.petId), + ]; const staffIds = allAppts.map(a => a.staffId).filter((id): id is string => id !== null); const petRows = petIds.length ? await db.select().from(pets).where(inArray(pets.id, petIds)) : []; @@ -217,7 +239,27 @@ portalRouter.get("/appointments", async (c) => { staff: a.staffId ? { id: staffMap[a.staffId]?.id, name: staffMap[a.staffId]?.name } : null, })); - return c.json({ appointments: appts }); + // Derive a display `startTime` from the entry's preferred date/time so the + // portal can sort/classify the synthetic card (an invalid combination simply + // yields a null startTime, which the portal tolerates). + const waitlistAppts = waitlistRows.map(w => { + const parsed = new Date(`${w.preferredDate}T${w.preferredTime}`); + const startTime = Number.isNaN(parsed.getTime()) ? null : parsed; + return { + id: `waitlist:${w.id}`, + startTime, + endTime: null, + status: "waitlisted" as const, + confirmationStatus: null, + customerNotes: null, + notes: null, + pet: { id: petMap[w.petId]?.id, name: petMap[w.petId]?.name, photo: petMap[w.petId]?.photoKey }, + service: { id: w.serviceId }, + staff: null, + }; + }); + + return c.json({ appointments: [...appts, ...waitlistAppts] }); }); portalRouter.get("/pets", async (c) => { From 58305d7a8961061411609eb2d7adf53228512ce4 Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Thu, 11 Jun 2026 08:33:52 +0000 Subject: [PATCH 10/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2342=20p?= =?UTF-8?q?ortal=20waitlist=20service=20{id,=20name}=20(frozen=20@47e2021?= =?UTF-8?q?=20+=20cherry-pick=20c737bfe)=20(#211)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Merge pull request 'GRO-2342: portal/appointments — symmetric service {id, name} on both card paths' (#211) from release/main-GRO-2342-api into main GRO-2342: GET /portal/appointments populates service: {id, name} on the synthetic waitlist card (was {id} only) and on the appointment card (consistent shape). TC-API-8.20 in UAT_PLAYBOOK.md. Approved CTO. Squashed from release/main-GRO-2342-api @ c737bfe. Refs: GRO-2342, GRO-2344, GRO-2345, GRO-2346, PR #211. Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- UAT_PLAYBOOK.md | 1 + src/__tests__/portal.test.ts | 57 ++++++++++++++++++++++++++++++++++++ src/routes/portal.ts | 20 +++++++++++-- 3 files changed, 75 insertions(+), 3 deletions(-) diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index 71d00ff..2a85e1d 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -288,6 +288,7 @@ This means: | TC-API-8.17 | SSO portal session slides on activity (GRO-2234) | Establish a portal session (TC-API-8.8). Note the returned `sessionId`. Make any authenticated portal call (e.g. `GET /api/portal/me`) several times spaced over ≥1 minute, each with `X-Impersonation-Session-Id: {sessionId}`. | Every call returns 200; the session's `expiresAt` is extended (slid forward to ~30 min from each request) so the session stays valid during continuous use — it does NOT lapse mid-session. SSO-bridge sessions mint with a 30-min idle TTL bounded by an 8h absolute cap from `startedAt`. | | TC-API-8.18 | Slow-wizard Book New submit succeeds (GRO-2234) | Establish a portal session (TC-API-8.8). Wait >2 minutes while making at least one intervening authenticated portal call (mimicking the multi-step Book New wizard: pet/service/groomer/date GETs). Then `POST /api/portal/waitlist` with a valid pet+service payload and the same `X-Impersonation-Session-Id`. | 201 Created — the deliberately-paced wizard no longer 401s on submit because activity slid the session forward. (Regression guard for the GRO-2234 "session TTL too short → 401" defect.) | | TC-API-8.19 | Portal appointments surface active waitlist entries (GRO-2319) | As `uat-customer@groombook.dev`, establish a portal session, then `GET /api/portal/appointments`. | 200 OK. In addition to the customer's appointments, the response includes the seeded ACTIVE waitlist entry as a synthetic card: `status: "waitlisted"`, `id` prefixed `waitlist:`, `confirmationStatus: null`, a non-null derived `startTime` (from the entry's preferred date/time), and the entry's `pet`. Cancelled/notified/expired waitlist entries are NOT surfaced. | +| TC-API-8.20 | Portal waitlist card populates service {id, name} (GRO-2342) | As `uat-customer@groombook.dev`, establish a portal session, then `GET /api/portal/appointments`. | 200 OK. The synthetic `waitlisted` card returned for the active waitlist entry has `service: {id: "", name: ""}` (full service record, not just `{id}`), matching the shape the appointments join returns. The portal Upcoming list therefore renders the actual service name in place of the fallback "Service" label. | ### 4.9 Waitlist diff --git a/src/__tests__/portal.test.ts b/src/__tests__/portal.test.ts index 84f37ab..1ac8bce 100644 --- a/src/__tests__/portal.test.ts +++ b/src/__tests__/portal.test.ts @@ -42,6 +42,7 @@ let selectAppointmentRow: Record | null = null; let selectWaitlistRows: Record[] = []; let selectPetRows: Record[] = []; let selectStaffRows: Record[] = []; +let selectServiceRows: Record[] = []; let updatedValues: Record[] = []; function resetMock() { @@ -50,6 +51,7 @@ function resetMock() { selectWaitlistRows = []; selectPetRows = []; selectStaffRows = []; + selectServiceRows = []; updatedValues = []; } @@ -83,6 +85,7 @@ vi.mock("@groombook/db", () => { const waitlistEntries = mkTable("waitlistEntries"); const pets = mkTable("pets"); const staff = mkTable("staff"); + const services = mkTable("services"); return { getDb: () => ({ @@ -103,6 +106,9 @@ vi.mock("@groombook/db", () => { if (table._name === "staff") { return makeChainable(selectStaffRows); } + if (table._name === "services") { + return makeChainable(selectServiceRows); + } return makeChainable([]); }, }), @@ -126,6 +132,7 @@ vi.mock("@groombook/db", () => { waitlistEntries, pets, staff, + services, eq: vi.fn(), and: vi.fn(), inArray: vi.fn(), @@ -198,6 +205,56 @@ describe("GET /portal/appointments (waitlist surfacing — GRO-2319)", () => { }); }); +// GRO-2342: GET /portal/appointments must populate the synthetic waitlist +// card's `service` object with the full service record (id + name) — same +// shape the appointments join returns — so the portal renders the real +// service name in place of the fallback "Service" label. +describe("GET /portal/appointments (waitlist service name — GRO-2342)", () => { + it("returns service {id, name} on the synthetic waitlist card", async () => { + selectSessionRow = ACTIVE_SESSION; + selectAppointmentRow = { ...APPOINTMENT }; + selectWaitlistRows = [ + { + id: "22222222-2222-2222-2222-222222222222", + petId: "pet-1", + serviceId: "svc-1", + preferredDate: "2099-01-01", + preferredTime: "13:00:00", + }, + ]; + selectPetRows = [{ id: "pet-1", name: "Rex", photoKey: null }]; + selectServiceRows = [{ id: "svc-1", name: "Full Groom" }]; + + const res = await app.request("/portal/appointments", { + headers: { "X-Impersonation-Session-Id": SESSION_ID }, + }); + expect(res.status).toBe(200); + const body = await res.json(); + const waitlistCard = body.appointments.find( + (a: { status: string }) => a.status === "waitlisted", + ); + expect(waitlistCard).toBeTruthy(); + expect(waitlistCard.service).toEqual({ id: "svc-1", name: "Full Groom" }); + }); + + it("returns service {id, name} on the appointment card (same shape)", async () => { + selectSessionRow = ACTIVE_SESSION; + selectAppointmentRow = { ...APPOINTMENT, serviceId: "svc-appt" }; + selectServiceRows = [{ id: "svc-appt", name: "Bath & Brush" }]; + + const res = await app.request("/portal/appointments", { + headers: { "X-Impersonation-Session-Id": SESSION_ID }, + }); + expect(res.status).toBe(200); + const body = await res.json(); + const apptCard = body.appointments.find( + (a: { status: string }) => a.status === "scheduled", + ); + expect(apptCard).toBeTruthy(); + expect(apptCard.service).toEqual({ id: "svc-appt", name: "Bath & Brush" }); + }); +}); + describe("PATCH /portal/appointments/:id/notes", () => { it("returns updated appointment with safe fields only", async () => { selectSessionRow = ACTIVE_SESSION; diff --git a/src/routes/portal.ts b/src/routes/portal.ts index 65c53a7..487861d 100644 --- a/src/routes/portal.ts +++ b/src/routes/portal.ts @@ -219,12 +219,22 @@ portalRouter.get("/appointments", async (c) => { ...waitlistRows.map(w => w.petId), ]; const staffIds = allAppts.map(a => a.staffId).filter((id): id is string => id !== null); + // GRO-2342: services must be looked up for both appointment and waitlist cards + // so the portal can render `service.name` in place of the fallback "Service" + // label (CMPO sign-off on the GRO-2319 waitlist card explicitly excluded the + // service name; this follow-up closes the cosmetic gap). + const serviceIds = [ + ...allAppts.map(a => a.serviceId).filter((id): id is string => id !== null), + ...waitlistRows.map(w => w.serviceId).filter((id): id is string => id !== null), + ]; const petRows = petIds.length ? await db.select().from(pets).where(inArray(pets.id, petIds)) : []; const staffRows = staffIds.length ? await db.select().from(staff).where(inArray(staff.id, staffIds)) : []; + const serviceRows = serviceIds.length ? await db.select().from(services).where(inArray(services.id, serviceIds)) : []; const petMap = Object.fromEntries(petRows.map(p => [p.id, p])); const staffMap = Object.fromEntries(staffRows.map(s => [s.id, s])); + const serviceMap = Object.fromEntries(serviceRows.map(s => [s.id, s])); const appts = allAppts.map(a => ({ id: a.id, @@ -235,13 +245,17 @@ portalRouter.get("/appointments", async (c) => { customerNotes: a.customerNotes, notes: a.notes, pet: a.petId ? { id: petMap[a.petId]?.id, name: petMap[a.petId]?.name, photo: petMap[a.petId]?.photoKey } : null, - service: a.serviceId ? { id: a.serviceId } : null, + service: a.serviceId ? { id: a.serviceId, name: serviceMap[a.serviceId]?.name } : null, staff: a.staffId ? { id: staffMap[a.staffId]?.id, name: staffMap[a.staffId]?.name } : null, })); // Derive a display `startTime` from the entry's preferred date/time so the // portal can sort/classify the synthetic card (an invalid combination simply - // yields a null startTime, which the portal tolerates). + // yields a null startTime, which the portal tolerates). GRO-2342: also + // populate the synthetic card's `service` object with the full service + // record (id + name) — same shape the appointments join returns — so the + // portal renders the real service name in place of the fallback "Service" + // label. const waitlistAppts = waitlistRows.map(w => { const parsed = new Date(`${w.preferredDate}T${w.preferredTime}`); const startTime = Number.isNaN(parsed.getTime()) ? null : parsed; @@ -254,7 +268,7 @@ portalRouter.get("/appointments", async (c) => { customerNotes: null, notes: null, pet: { id: petMap[w.petId]?.id, name: petMap[w.petId]?.name, photo: petMap[w.petId]?.photoKey }, - service: { id: w.serviceId }, + service: w.serviceId ? { id: w.serviceId, name: serviceMap[w.serviceId]?.name } : null, staff: null, }; }); From bedeb05a67ef6f80613bbe8309c33e115c0152cb Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Fri, 12 Jun 2026 16:47:30 +0000 Subject: [PATCH 11/14] =?UTF-8?q?Promote=20uat=20=E2=86=92=20main=20(PROD)?= =?UTF-8?q?:=20GRO-2359=20OOBE=20portal-creation=20routing=20(api)=20(#214?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GRO-2359: add POST /api/portal/clients-from-auth for OOBE (#214) Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- src/__tests__/portalClientsFromAuth.test.ts | 201 ++++++++++++++++++++ src/routes/portal.ts | 108 +++++++++++ 2 files changed, 309 insertions(+) create mode 100644 src/__tests__/portalClientsFromAuth.test.ts diff --git a/src/__tests__/portalClientsFromAuth.test.ts b/src/__tests__/portalClientsFromAuth.test.ts new file mode 100644 index 0000000..dd2e899 --- /dev/null +++ b/src/__tests__/portalClientsFromAuth.test.ts @@ -0,0 +1,201 @@ +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { Hono } from "hono"; +import { getAuth } from "../lib/auth.js"; + +const NEW_USER_EMAIL = "new-sso-user@example.com"; +const NEW_USER_NAME = "New SSO User"; +const NEW_USER_ID = "11111111-2222-3333-4444-555555555555"; + +const BETTER_AUTH_SESSION = { + user: { + id: "auth-user-new", + email: NEW_USER_EMAIL, + name: NEW_USER_NAME, + }, + session: { + id: "ba-session-new", + expiresAt: new Date(Date.now() + 60 * 60 * 1000), + }, +}; + +let mockGetAuth: ReturnType; +let mockGetSession: ReturnType; +let existingClientRow: Record | null = null; +let insertedClientValues: Record | null = null; +let insertShouldThrow: { code?: string } | null = null; + +function makeChainable(data: unknown[]): unknown { + const arr = [...data]; + return new Proxy(arr, { + get(target, prop) { + if (prop === "where" || prop === "orderBy" || prop === "limit") { + return () => makeChainable(target); + } + // @ts-expect-error proxy + return target[prop]; + }, + }); +} + +vi.mock("@groombook/db", () => { + const clients = new Proxy( + { _name: "clients" }, + { get: (t, p) => (p === "_name" ? "clients" : { table: "clients", column: p }) } + ); + + return { + getDb: () => ({ + select: () => ({ + from: (table: { _name: string }) => { + if (table._name === "clients") { + return makeChainable(existingClientRow ? [existingClientRow] : []); + } + return makeChainable([]); + }, + }), + insert: (table: { _name: string }) => ({ + values: (vals: Record) => { + if (insertShouldThrow) { + const err = new Error("unique violation") as Error & { code?: string }; + err.code = insertShouldThrow.code; + throw err; + } + return { + returning: () => { + if (table._name === "clients") { + insertedClientValues = { id: NEW_USER_ID, ...vals }; + return [insertedClientValues]; + } + return []; + }, + }; + }, + }), + }), + clients, + eq: vi.fn(), + and: vi.fn(), + inArray: vi.fn(), + }; +}); + +vi.mock("../lib/auth.js", () => ({ + getAuth: vi.fn(), +})); + +const { portalRouter } = await import("../routes/portal.js"); + +const app = new Hono(); +app.route("/portal", portalRouter); + +describe("POST /portal/clients-from-auth (GRO-2359)", () => { + beforeEach(() => { + existingClientRow = null; + insertedClientValues = null; + insertShouldThrow = null; + mockGetSession = vi.fn(); + mockGetAuth = vi.fn(() => ({ + api: { + getSession: mockGetSession, + }, + })); + vi.mocked(getAuth).mockImplementation(mockGetAuth); + }); + + it("returns 401 when no Better Auth session is present", async () => { + mockGetSession.mockResolvedValue(null); + const res = await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ name: "Test User" }), + }); + expect(res.status).toBe(401); + const body = await res.json(); + expect(body.error).toBe("Unauthorized"); + }); + + it("returns 400 when body fails zod validation (empty name)", async () => { + mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION); + const res = await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ name: "" }), + }); + expect(res.status).toBe(400); + }); + + it("creates a new client row bound to the auth user's email and returns 201", async () => { + mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION); + const res = await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ + name: " New SSO User ", + phone: "555-1234", + address: "1 Main St", + notes: "test note", + }), + }); + expect(res.status).toBe(201); + const body = await res.json(); + expect(body).toMatchObject({ + id: NEW_USER_ID, + name: "New SSO User", + email: NEW_USER_EMAIL, + }); + // Trim must be applied to the persisted values. + expect(insertedClientValues).not.toBeNull(); + expect((insertedClientValues as Record).name).toBe("New SSO User"); + expect((insertedClientValues as Record).email).toBe(NEW_USER_EMAIL); + expect((insertedClientValues as Record).phone).toBe("555-1234"); + }); + + it("normalizes empty optional fields to null on insert", async () => { + mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION); + await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ name: "Test", phone: "", address: " " }), + }); + expect(insertedClientValues).not.toBeNull(); + expect((insertedClientValues as Record).phone).toBeNull(); + expect((insertedClientValues as Record).address).toBeNull(); + }); + + it("returns 409 when a client row already exists for this email", async () => { + mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION); + existingClientRow = { id: "existing-client-id", email: NEW_USER_EMAIL }; + const res = await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ name: "Test" }), + }); + expect(res.status).toBe(409); + const body = await res.json(); + expect(body.error).toMatch(/already exists/i); + expect(insertedClientValues).toBeNull(); + }); + + it("returns 409 on unique constraint race (23505)", async () => { + mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION); + insertShouldThrow = { code: "23505" }; + const res = await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ name: "Test" }), + }); + expect(res.status).toBe(409); + }); + + it("returns 503 when auth is not configured", async () => { + mockGetAuth.mockImplementation(() => { + throw new Error("Auth not initialized"); + }); + const res = await app.request("/portal/clients-from-auth", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ name: "Test" }), + }); + expect(res.status).toBe(503); + }); +}); diff --git a/src/routes/portal.ts b/src/routes/portal.ts index 487861d..17425a3 100644 --- a/src/routes/portal.ts +++ b/src/routes/portal.ts @@ -147,6 +147,114 @@ portalRouter.post("/session-from-auth", async (c) => { ); }); +// GRO-2359 — register a brand-new SSO user. The post-auth handler in the +// web portal redirects here when `session-from-auth` returns 404, so the +// OOBE can complete a customer record for the new user. Auth is via the +// Better Auth session (same shape as `session-from-auth`), so this is +// registered BEFORE the `validatePortalSession` middleware. +// +// Contract: +// POST /api/portal/clients-from-auth +// Body: { name: string; phone?: string|null; address?: string|null; notes?: string|null } +// 201: { id, name, email } +// 400: invalid body (zod failure) +// 401: no Better Auth session +// 409: a `clients` row already exists for this email (portal selection case) +// 500: insert failed +// +// We do NOT auto-link the user's auth account to the new client row; the +// existing `session-from-auth` endpoint re-resolves the row by email on the +// next call, so the OOBE's success path just navigates the user back to +// `/` and lets the bridge mint a portal session. +const createClientFromAuthSchema = z.object({ + name: z.string().min(1).max(200), + phone: z.string().max(50).nullish(), + address: z.string().max(500).nullish(), + notes: z.string().max(2000).nullish(), +}); + +portalRouter.post( + "/clients-from-auth", + zValidator("json", createClientFromAuthSchema), + async (c) => { + let auth; + try { + auth = getAuth(); + } catch { + return c.json({ error: "Authentication not configured" }, 503); + } + + const session = await auth.api.getSession({ + headers: c.req.raw.headers, + }); + + if (!session) { + return c.json({ error: "Unauthorized" }, 401); + } + + const body = c.req.valid("json"); + const db = getDb(); + + // Pre-check: if a client already exists for this email, return 409 so + // the OOBE can render the "portal selection" message (the user needs + // to contact their groomer to link the new SSO identity to the + // pre-existing customer record). We don't return the existing row to + // avoid leaking PII about other accounts. + const [existing] = await db + .select({ id: clients.id }) + .from(clients) + .where(eq(clients.email, session.user.email)) + .limit(1); + + if (existing) { + return c.json( + { error: "A customer record with this email already exists" }, + 409, + ); + } + + let row; + try { + [row] = await db + .insert(clients) + .values({ + name: body.name.trim(), + email: session.user.email, + phone: body.phone?.trim() || null, + address: body.address?.trim() || null, + notes: body.notes?.trim() || null, + }) + .returning(); + } catch (err) { + // Concurrent insert from a parallel OOBE submit — treat as 409. + if ( + err instanceof Error && + "code" in err && + (err as { code?: string }).code === "23505" + ) { + return c.json( + { error: "A customer record with this email already exists" }, + 409, + ); + } + throw err; + } + + if (!row) { + return c.json({ error: "Failed to create client" }, 500); + } + + return c.json( + { + id: row.id, + name: row.name, + email: row.email, + }, + 201, + ); + }, +); + // Apply middleware to all portal routes portalRouter.use("/*", validatePortalSession, portalAudit); From ed51a59c8087149e878d8092a6cb83635c5d5f54 Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Fri, 12 Jun 2026 17:00:40 +0000 Subject: [PATCH 12/14] docs: add AGENTS.md and CONTRIBUTING.md (GRO-2381) (#215) Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net> --- AGENTS.md | 54 ++++++++++++++++++++++ CONTRIBUTING.md | 117 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 171 insertions(+) create mode 100644 AGENTS.md create mode 100644 CONTRIBUTING.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..c9ae143 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,54 @@ +# AGENTS.md + +This repository (`groombook/api`) is part of the GroomBook application stack. The +authoritative process, quality bar, and safety rules live in the shared +[`groombook/org`](https://git.farh.net/groombook/org) skills repository. Read +those first; this file is only a pointer. + +## Authoritative skills + +- **SDLC (branching, PRs, phases, handoffs):** + [`groombook/org/skills/sdlc/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/sdlc/SKILL.md) +- **Coding standards (priority ordering, PR discipline, tests, no-hardcoded-values, CalVer):** + [`groombook/org/skills/coding-standards/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/coding-standards/SKILL.md) +- **Safety (no plaintext secrets, no direct `kubectl apply` to `groombook`, no self-merge, board approval for destructive actions):** + [`groombook/org/skills/safety/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/safety/SKILL.md) + +For human contributors and humans reviewing agent work, see +[`CONTRIBUTING.md`](./CONTRIBUTING.md) in this repo for the phase-by-phase PR +flow and the `uat→main` merge-gate policy summary. + +## Non-negotiable operational rules + +These mirror the org skills; they are restated here so any agent landing in +this repo sees them without a cross-repo fetch. + +- **All changes go through a PR.** Never push directly to `dev`, `uat`, or `main`. +- **Branch strategy:** `feature/` → `dev` → `uat` → `main`. Engineers + always target `dev` first. +- **No self-merge contract.** The engineer who opened a PR clicks merge only + after the named reviewer (CI / QA / UAT / Security / CTO per phase) + approves. Issue-thread QA / UAT / security approvals do **not** clear the + Gitea `required_approvals` gate on `uat→main` — only a Gitea **Approve** + click from a member of the `approvals_whitelist_username` does. On this + repo that whitelist is `["gb_flea", "gb_dogfather"]` (engineer team). + Board-level accounts cannot give the Approve click by policy. +- **Always include `cc @cpfarhood`** at the bottom of every PR body for + board visibility (not as a reviewer). +- **Secrets in code are forbidden.** Use Bitnami Sealed Secrets; never commit + plaintext. See the `safety` skill. +- **Production (`groombook` namespace) is Flux-managed.** Never + `kubectl apply` directly. Infrastructure changes go through PRs in + `groombook/infra`. + +## Local development + +See the repo's own README, package scripts, and CI workflow. The +authoritative pipeline (Gitea Actions, image build, deploy hooks) is the +shared `groombook/infra` overlay; do not reimplement it here. + +## When uncertain + +If a task conflicts with the org skills, **the org skills win**. Open an +issue in `groombook/org` to propose a change rather than encoding a local +exception. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..64a918a --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,117 @@ +# Contributing to `groombook/api` + +Thanks for contributing. This document is the human-facing companion to +[`AGENTS.md`](./AGENTS.md) and the authoritative +[`groombook/org`](https://git.farh.net/groombook/org) skills. The org skills +govern; this file is a quick-reference for the human/agent PR flow in this +repo. + +## Branch strategy + +Three long-lived branches; one PR per promotion step. + +| Branch | Environment | Who merges | Prerequisites for merge | +|---------|-------------|-----------|-------------------------| +| `dev` | Dev | Engineer | CI passes | +| `uat` | UAT | Engineer | QA code review approval | +| `main` | Production | Engineer | UAT validation + CTO Gitea Approve when the `uat→main` merge-gate policy applies (see below) | + +Engineers always target `dev` first. Feature branches: `/`. + +## Phase-by-phase PR flow + +### Phase 1 — Dev + +1. Branch from `dev`: `git checkout -b / origin/dev`. +2. Write code + tests. Run unit tests, type check, and lint locally (or rely on CI). +3. Open a PR against `dev`: + ```bash + tea pr create --base dev --title "..." --body "..." + ``` + Include `cc @cpfarhood` at the bottom of the body for board visibility. +4. CI must pass. CI green → engineer self-merges. +5. CI builds and deploys to Dev automatically. + +### Phase 2 — UAT promotion + +1. Open a PR from `dev` to `uat`. +2. CI must pass. +3. **QA (Lint Roller)** reviews and approves on the Gitea PR. +4. QA approved → engineer self-merges. +5. CI builds and deploys to UAT automatically. + +### Phase 3 — UAT regression + Security review + +1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every + feature, old and new, no exceptions. +2. **Security (Barkley Trimsworth)** reviews the changes. +3. Failures in either gate bounce back to Phase 1. + +### Phase 4 — Production promotion (`uat → main`) + +This is the gate the org PR +[`groombook/org#13`](https://git.farh.net/groombook/org/pulls/13) defines. +The full rule is in +[`groombook/org/skills/sdlc/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/sdlc/SKILL.md) +and +[`groombook/org/skills/coding-standards/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/coding-standards/SKILL.md); +the summary is below. + +**The CTO Gitea Approve click is NOT the default gate.** Once the four +pre-gates (QA, UAT deploy, UAT regression, security) are green, the engineer +self-merges. + +**A CTO Gitea Approve click IS required** only for PRs in one of three +categories: + +1. **Novel auth / session paths** — login, OIDC, OOBE, session middleware, + token issuance, password reset, MFA, new auth provider integrations. + Routine auth-gated UI (button styling, error messages, form layout) is + **not** in this category. +2. **Infra / prod-affecting merges** — deploys, infra manifests, secrets, + GitOps overlays, CI/CD, `main` branch protection, production + routing/ingress, prod state mutations. All Phase 5 infra overlay PRs in + `groombook/infra` require CTO Gitea Approve without exception. +3. **Risk-flagged merges** — `risk:cto-approve` label, or explicit CTO/CEO + sign-off request in the PR or issue thread. + +The engineer opens the `uat→main` PR, classifies it against the three +categories above, and adds `cc @cpfarhood`. If the PR is in scope, the CTO +clicks Approve; once approved (and the four pre-gates are green), the +engineer merges. + +### Phase 5 — Production deployment + +A separate PR in `groombook/infra` bumps the overlay image tag for prod. +Handed to QA (Lint Roller) for review, then self-merged by the engineer. + +## The four pre-gates (uat→main) + +A `uat→main` PR is mergeable when **all four** are green: + +1. **QA code review** — done on the dev→uat promotion PR. +2. **UAT deploy** — the UAT image built from the uat tip is live in UAT. +3. **UAT regression** — Shedward's full-feature UAT pass is green (no + pre-existing defects, no new defects). +4. **Security review** — Barkley's security code review is green. + +Issue-thread QA / UAT / security approvals do **not** clear the Gitea +`required_approvals` gate. Only a Gitea **Approve** click from a member of +the `approvals_whitelist_username` for `main` clears it. In this repo that +whitelist is the engineer team (`gb_flea`, `gb_dogfather`). + +## Style, tests, and quality bar + +See +[`groombook/org/skills/coding-standards/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/coding-standards/SKILL.md) +for the engineering priority ordering, test requirements, no-hardcoded-values +rules, CalVer versioning policy, and the `git.farh.net` container registry +policy. + +## Safety + +See +[`groombook/org/skills/safety/SKILL.md`](https://git.farh.net/groombook/org/src/branch/main/skills/safety/SKILL.md) +for the non-negotiable rules: no plaintext secrets, no `kubectl apply` to +`groombook`, no self-merge, no direct `tofu` runs, board approval for +destructive actions, escalation protocol. From 1b6cd5825ac508330a77c2e786c20a9952d2ed58 Mon Sep 17 00:00:00 2001 From: Flea Flicker Date: Thu, 18 Jun 2026 02:14:23 +0000 Subject: [PATCH 13/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2425=20c?= =?UTF-8?q?omma-split=20CORS=5FORIGIN=20(frozen=20@63d7aaa)=20(#218)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit feat: support comma-split CORS_ORIGIN for multiple trusted auth origins (GRO-2425) Co-authored-by: Flea Flicker Co-committed-by: Flea Flicker --- UAT_PLAYBOOK.md | 2 ++ src/lib/auth.ts | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index 2a85e1d..66ef0d5 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -108,6 +108,8 @@ Expected: one row, `role = 'groomer'`. If zero rows return, the request hit the | TC-API-1.24 | Complete setup creates super user | POST /api/setup with business name (after TC-API-1.23) | First user becomes super user, setup completes | Setup errors, 403 on admin endpoints | | TC-API-1.25 | Super user accesses admin features | After TC-API-1.24, GET /api/staff/me and verify isSuperUser: true | isSuperUser: true, admin endpoints accessible | 403 on admin, isSuperUser: false | | TC-API-1.26 | Auto-provision skipped during OOBE | During fresh setup (needsSetup: true), complete OIDC login — verify no duplicate staff record created before setup completes | No duplicate staff, OOBE completes successfully | Duplicate staff record, 403 before setup, auto-provision interferes with OOBE | +| TC-API-1.27 | Multi-origin CORS — demo host sign-in | `POST /api/auth/sign-in/social` with `callbackURL=https://demo.groombook.dev` | 200 OK, no origin-mismatch error | 400/403 "Origin mismatch" | +| TC-API-1.28 | Multi-origin CORS — farh.net host sign-in | `POST /api/auth/sign-in/social` with `callbackURL=https://groombook.farh.net` | 200 OK, no origin-mismatch error | 400/403 "Origin mismatch" | ### 4.2 Client Management diff --git a/src/lib/auth.ts b/src/lib/auth.ts index ff1e125..b28153d 100644 --- a/src/lib/auth.ts +++ b/src/lib/auth.ts @@ -118,7 +118,8 @@ export async function initAuth(): Promise { updateAge: 60 * 60 * 24, cookieCache: { enabled: false }, }, - trustedOrigins: [process.env.CORS_ORIGIN ?? "http://localhost:5173"], + trustedOrigins: (process.env.CORS_ORIGIN ?? "http://localhost:5173") + .split(",").map((s) => s.trim()).filter(Boolean), }); return; } @@ -308,7 +309,8 @@ export async function initAuth(): Promise { maxAge: 5 * 60, // 5 minutes }, }, - trustedOrigins: [process.env.CORS_ORIGIN ?? "http://localhost:5173"], + trustedOrigins: (process.env.CORS_ORIGIN ?? "http://localhost:5173") + .split(",").map((s) => s.trim()).filter(Boolean), }); })(); From 98b1171f9864614c2909510e52cee4cccabeefd2 Mon Sep 17 00:00:00 2001 From: Flea Flicker <22+gb_flea@noreply.git.farh.net> Date: Fri, 26 Jun 2026 14:23:34 +0000 Subject: [PATCH 14/14] =?UTF-8?q?uat=E2=86=92main=20(PROD):=20GRO-2586=20C?= =?UTF-8?q?ORS=20origin=20allowlist=20enforcement=20(frozen=20@2d4edb6)=20?= =?UTF-8?q?(#221)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit uat→main (PROD): GRO-2586 CORS origin allowlist enforcement (frozen @2d4edb6) --- UAT_PLAYBOOK.md | 3 ++ src/__tests__/authCors.test.ts | 60 ++++++++++++++++++++++++++++++++++ src/index.ts | 6 ++-- src/lib/auth-cors.ts | 22 +++++++++++++ 4 files changed, 89 insertions(+), 2 deletions(-) create mode 100644 src/__tests__/authCors.test.ts create mode 100644 src/lib/auth-cors.ts diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index 66ef0d5..60acc87 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -110,6 +110,9 @@ Expected: one row, `role = 'groomer'`. If zero rows return, the request hit the | TC-API-1.26 | Auto-provision skipped during OOBE | During fresh setup (needsSetup: true), complete OIDC login — verify no duplicate staff record created before setup completes | No duplicate staff, OOBE completes successfully | Duplicate staff record, 403 before setup, auto-provision interferes with OOBE | | TC-API-1.27 | Multi-origin CORS — demo host sign-in | `POST /api/auth/sign-in/social` with `callbackURL=https://demo.groombook.dev` | 200 OK, no origin-mismatch error | 400/403 "Origin mismatch" | | TC-API-1.28 | Multi-origin CORS — farh.net host sign-in | `POST /api/auth/sign-in/social` with `callbackURL=https://groombook.farh.net` | 200 OK, no origin-mismatch error | 400/403 "Origin mismatch" | +| TC-API-1.29 | CORS — untrusted origin blocked (GRO-2586) | POST /api/auth/sign-in/social with `Origin: https://evil.example.com` header | Response has **no** `Access-Control-Allow-Origin` header — attacker origin is not reflected | `Access-Control-Allow-Origin: https://evil.example.com` present in response | +| TC-API-1.30 | CORS — trusted origin allowed (GRO-2586) | POST /api/auth/sign-in/social with `Origin: https://uat.groombook.dev` header | `Access-Control-Allow-Origin: https://uat.groombook.dev` + `Access-Control-Allow-Credentials: true` | CORS header absent or trusted origin rejected | +| TC-API-1.31 | CORS — untrusted preflight blocked (GRO-2586) | `curl -i -X OPTIONS https://uat.groombook.dev/api/auth/sign-in/social -H 'Origin: https://evil.example.com' -H 'Access-Control-Request-Method: POST'` | Response has **no** `Access-Control-Allow-Origin: https://evil.example.com` | Preflight reflects attacker origin | ### 4.2 Client Management diff --git a/src/__tests__/authCors.test.ts b/src/__tests__/authCors.test.ts new file mode 100644 index 0000000..2603279 --- /dev/null +++ b/src/__tests__/authCors.test.ts @@ -0,0 +1,60 @@ +import { describe, it, expect } from "vitest"; +import { enforceAuthCors } from "../lib/auth-cors.js"; + +const TRUSTED = ["https://uat.groombook.dev", "https://dev.groombook.dev"]; + +/** Simulates Better Auth reflecting the request Origin (the pre-fix bug). */ +function makeReflectedResponse(origin: string | null): Response { + return new Response('{"ok":true}', { + status: 200, + headers: { + "Content-Type": "application/json", + ...(origin + ? { + "Access-Control-Allow-Origin": origin, + "Access-Control-Allow-Credentials": "true", + } + : {}), + }, + }); +} + +describe("enforceAuthCors (GRO-2586)", () => { + it("passes trusted origin through with credentials", () => { + const origin = "https://uat.groombook.dev"; + const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin)); + expect(res.headers.get("Access-Control-Allow-Origin")).toBe(origin); + expect(res.headers.get("Access-Control-Allow-Credentials")).toBe("true"); + }); + + it("strips ACAO for attacker origin (credentialed cross-origin read blocked)", () => { + const origin = "https://evil.example.com"; + const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin)); + expect(res.headers.get("Access-Control-Allow-Origin")).toBeNull(); + expect(res.headers.get("Access-Control-Allow-Credentials")).toBeNull(); + }); + + it("strips ACAO when no Origin header (undefined)", () => { + const res = enforceAuthCors(undefined, TRUSTED, makeReflectedResponse(null)); + expect(res.headers.get("Access-Control-Allow-Origin")).toBeNull(); + expect(res.headers.get("Access-Control-Allow-Credentials")).toBeNull(); + }); + + it("preserves non-CORS response headers and status from Better Auth", () => { + const origin = "https://evil.example.com"; + const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin)); + expect(res.headers.get("Content-Type")).toBe("application/json"); + expect(res.status).toBe(200); + }); + + it("second trusted origin is also allowed", () => { + const origin = "https://dev.groombook.dev"; + const res = enforceAuthCors(origin, TRUSTED, makeReflectedResponse(origin)); + expect(res.headers.get("Access-Control-Allow-Origin")).toBe(origin); + }); + + it("empty string origin is treated as untrusted", () => { + const res = enforceAuthCors("", TRUSTED, makeReflectedResponse("")); + expect(res.headers.get("Access-Control-Allow-Origin")).toBeNull(); + }); +}); diff --git a/src/index.ts b/src/index.ts index 681d731..6c0c930 100644 --- a/src/index.ts +++ b/src/index.ts @@ -3,6 +3,7 @@ import { Hono } from "hono"; import { logger } from "hono/logger"; import { cors } from "hono/cors"; import { getAuth, initAuth, getActiveProviders } from "./lib/auth.js"; +import { enforceAuthCors } from "./lib/auth-cors.js"; import { clientsRouter } from "./routes/clients.js"; import { petsRouter } from "./routes/pets.js"; import { servicesRouter } from "./routes/services.js"; @@ -200,9 +201,10 @@ api.use("*", resolveStaffMiddleware); // Better-Auth handler — mounted as sub-app to handle all /api/auth/* routes // authMiddleware and resolveStaffMiddleware both skip /api/auth/ paths const authRouter = new Hono(); -authRouter.all("/*", (c) => { +authRouter.all("/*", async (c) => { try { - return getAuth().handler(c.req.raw); + const res = await getAuth().handler(c.req.raw); + return enforceAuthCors(c.req.header("origin"), TRUSTED_ORIGINS, res); } catch { return c.json({ error: "Authentication not configured" }, 503); } diff --git a/src/lib/auth-cors.ts b/src/lib/auth-cors.ts new file mode 100644 index 0000000..bd68f38 --- /dev/null +++ b/src/lib/auth-cors.ts @@ -0,0 +1,22 @@ +/** + * Enforces the trusted-origins CORS allowlist on a raw Response from Better Auth. + * Better Auth reflects the request Origin into Access-Control-Allow-Origin + * regardless of the trustedOrigins config, allowing credentialed cross-origin reads + * from arbitrary attacker origins. This wrapper strips CORS headers for any origin + * not in the allowlist. (GRO-2586) + */ +export function enforceAuthCors( + requestOrigin: string | undefined, + trustedOrigins: string[], + res: Response +): Response { + const headers = new Headers(res.headers); + if (requestOrigin && trustedOrigins.includes(requestOrigin)) { + headers.set("Access-Control-Allow-Origin", requestOrigin); + headers.set("Access-Control-Allow-Credentials", "true"); + } else { + headers.delete("Access-Control-Allow-Origin"); + headers.delete("Access-Control-Allow-Credentials"); + } + return new Response(res.body, { status: res.status, statusText: res.statusText, headers }); +}