fix(GRO-1272): auto-provision staff record on first OIDC login (#19)
Fixes HTTP 403 on all authenticated routes for new OIDC users by auto-creating
a minimal groomer staff record on first login when a Better-Auth user exists
but no staff record is found.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
GRO-1325 was marked done but never implemented. This adds the missing
Better-Auth user + account seeding for UAT email+password logins.
For each SEED_UAT_*_PASSWORD env var present, the seed now:
1. Creates (or links to existing) a Better-Auth user record with
emailVerified: true
2. Creates a credential account with providerId: "credential"
and a bcrypt-hashed password (using better-auth/crypto)
3. Links the staff record to the Better-Auth user via userId
Idempotent: skips user/account creation if already seeded.
Updated UAT_PLAYBOOK.md §4.1 — TC-API-1.4 through 1.9 now reference
the new seed provisioning (GRO-1325 was the missing piece).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Re-implement lost commit from worktree cleanup. PR #12 already has
UAT_PLAYBOOK + factories fix; add all missing core implementation:
- Add petSizeCategoryEnum/coatTypeEnum to schema
- Add bufferRules table with service FK + unique constraint
- Add defaultBufferMinutes column to services table
- Change pets.coatType/petSizeCategory text columns to use enums
- Add routes/buffer-rules.ts: GET/POST/PATCH/DELETE, manager role guard
- Register /api/buffer-rules in index.ts
- Update services.ts PATCH to accept defaultBufferMinutes
- Update pets.ts POST/PATCH to accept sizeCategory/coatType
- Cast coatType/petSizeCategory in book.ts insert to match new enums
- Add 0031_buffer_rules.sql migration
- Fix factories.ts buildService to include defaultBufferMinutes: null
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Address QA review findings on PR #12:
- Add coatType and petSizeCategory to buildPet defaults in packages/db/src/factories.ts
to fix TypeScript typecheck failure
- Restore UAT_PLAYBOOK.md (was deleted during monorepo extraction) and add
§4.15 Buffer Rules test cases
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Sync api packages/types with web workspace — add MedicalAlert, AlertSeverity,
CoatType, preferredCuts, medicalAlerts, temperamentScore, temperamentFlags.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add petSizeCategory and petCoatType to bookingSchema zod validator (optional)
- Save coatType to pets row on booking creation
- Add coatType and petSizeCategory columns to pets DB schema
- Add coatType and petSizeCategory to Pet interface in @groombook/types
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Two pre-existing bugs prevented petsExtendedFields.test.ts from running:
1. vi.mock factory referenced bare `and`, `eq`, `exists`, `or` variables
that are undefined at hoist time — replaced with inline mock functions
2. CLIENT_ID/PET_ID used non-UUID strings but Zod schema requires uuid()
All 36 test files (521 tests) now pass.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add drizzle-orm ^0.38.4 and postgres ^3.4.5 to root package.json
dependencies so that pnpm --frozen-lockfile install in CI makes
them available at the root node_modules level.
apps/api is not a pnpm workspace member (workspace declares
packages: ["apps/*"]), so CI's pnpm install does not reach into
apps/api/node_modules/. Adding these deps to the root package.json
fixes the ERR_MODULE_NOT_FOUND error that Vitest encountered when
running tests under pnpm --frozen-lockfile.
Also moves drizzle-orm and postgres from apps/api/devDependencies
to dependencies per the issue spec.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Rename insertedStaff to _insertedStaff (ESLint unused var, line 49)
- Rename table param to _table in insert mock (ESLint unused param, line 91)
- Fix buildApp jwtPayload to prefer userLookupResult.id over staffLookupResult.userId
(corrects auto-provision test failures where sub was 'unknown-sub' instead of 'ba-user-new')
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add null guard for newStaff after .returning() in auto-provision block
- Make buildQuery() iterable without .limit() call (for WHERE-only queries)
- Use fallback in .limit() for manager-fallback dev-mode tests
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add user table mock and db.insert returning chain to rbac.test.ts
- Add three new tests: happy-path auto-provision, email-prefix fallback,
and miss-path (no user → 403)
- Add TC-API-1.4 to UAT_PLAYBOOK.md §4.1 for first-login auto-provision
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
When a user authenticates via OIDC but has no staff record (userId NULL,
oidcSub mismatch, email mismatch), resolveStaffMiddleware now checks for
a Better-Auth user record by jwt.sub and auto-creates a minimal groomer
staff record on first login.
This fixes the UAT regression where all API routes returned 403 for all
authenticated users after GRO-1207, because seedKnownUsers() sets
oidcSub to Authentik integer PKs or emails rather than the actual Authentik
OIDC sub (a UUID). The auto-provision path bridges the gap for all UAT
personas without requiring seed/Terraform changes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Merges the dev branch history into gitea/migrate-workflows to resolve
PR #24. The two branches had unrelated git histories due to the Gitea
migration. Conflict resolution favors gitea/migrate-workflows for
packages/, src/, .gitea/ structure and dev for apps/, .github/ content.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use pnpm --filter consistently for all three package builds in the
Dockerfile instead of mixing filter and cd approaches. Also set
--project . explicitly on tsc invocations to ensure tsconfig resolution
from the package directory rather than workspace root.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
tsc -p /app does not resolve to tsconfig.json at /app/tsconfig.json
without an explicit filename. Pass the full path.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
When pnpm --filter runs the api package build, tsc cannot find the
tsconfig.json. Use an absolute path to avoid any ambiguity about the
working directory context.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Both -p . and --project . should be equivalent, but the Docker build
appears to resolve them differently. Use -p for consistency.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
pnpm --filter runs in the workspace root where tsc finds the root
tsconfig.json instead of packages/db/tsconfig.json. Change into the
package directory so tsc picks up the correct local tsconfig.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
tsc without --project traverses up to workspace root, which has a
different tsconfig.json that lacks package-local paths. Fix both
@groombook/types and @groombook/db scripts consistently.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
tsc without --project flag picks up tsconfig.json from the workspace
root, which lacks the packages/* paths needed for the monorepo build.
Explicit --project . ensures tsc uses the local tsconfig.json.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
PetRow (pets.$inferSelect) now includes these nullable columns after
the GRO-1174 migration, but buildPet's defaults were never updated.
Adding null defaults fixes the typecheck failure in CI.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tsc without --project flag fails to find tsconfig.json when run from
a nested package directory inside a Docker COPY layer that overlays
files after deps install. Use explicit --project . to ensure tsc
finds the local tsconfig.json regardless of working directory context.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sync api packages/types with web workspace — add MedicalAlert, AlertSeverity,
CoatType, preferredCuts, medicalAlerts, temperamentScore, temperamentFlags.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add petSizeCategory and petCoatType to bookingSchema zod validator (optional)
- Save coatType to pets row on booking creation
- Add coatType and petSizeCategory columns to pets DB schema
- Add coatType and petSizeCategory to Pet interface in @groombook/types
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- hashPassword is now async — all callers await it
- AC-3/AC-1 assertions updated to expect hex format (saltHex:keyHex)
- Destructuring replaced with explicit array access to fix TS strictness on
possibly-undefined split() result
- scrypt verification removed from test (N=16384 exceeds CI runner memory;
format assertions are sufficient)
- Removed unused scryptSync import
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The seed.ts password hashing used N=32768, r=8, p=1 with base64 encoding,
which does not match @better-auth/utils@0.4.0's actual implementation
(N=16384, r=16, p=1, dkLen=64, hex encoding). This caused every seeded
UAT credential to fail verifyPassword at sign-in.
Fix: import hashPassword from "better-auth/crypto" in seed.ts and in the
test helper. This delegates to Better-Auth's own implementation,
guaranteeing parameter and encoding match.
Also updates test assertions to expect hex format (saltHex:keyHex) and
verifies the hash using the correct scrypt params (N=16384, r=16, p=1).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the org-level REGISTRY_TOKEN secret instead of gitea.token for
authenticating to the Gitea Container Registry. The gitea.token
does not have packages:write scope.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Removes types/index.ts and factories.ts changes that belong in PR #21
(GRO-1178), not this PR. The extended Pet type fields caused CI typecheck
failures because the seed/credential logic doesn't use them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add coatType, temperamentScore, temperamentFlags, medicalAlerts,
preferredCuts to buildPet() defaults — schema recently added these
columns but factories was still missing them, causing TS2739 errors
- Reduce scrypt N from 32768 → 4096 in test helpers only — production
seed.ts is unaffected; CI runners hit memory limit at N=32768
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds seed-uat-credentials.test.ts covering all 7 acceptance criteria:
- AC-1: creates user + account for each UAT account with password env var
- AC-2: emailVerified = true on created users
- AC-3: providerId = "credential", password properly hashed (scrypt, salt:hash)
- AC-4/AC-4b: staff.userId linked when staff exists, not updated if already set
- AC-5: idempotent — re-running creates no duplicates
- AC-6: missing SEED_UAT_*_PASSWORD skips that account with warning (no error)
- AC-7: partial env var coverage — only provisioned accounts get created
References GRO-1326.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds a seeding step after UAT staff creation that:
- Creates Better-Auth user records (emailVerified: true) for 4 UAT accounts
- Creates account records with providerId="credential" and scrypt-hashed passwords
- Links staff.userId for accounts with existing staff records (super, groomer, tester)
- Reads passwords from SEED_UAT_*_PASSWORD env vars (guard clause skips if unset)
- Is fully idempotent (upsert-safe)
Bypasses Authentik SSO for UAT login; Shedward can authenticate via
POST /api/auth/sign-in/email using the same UAT password secrets.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The Dogfather
Flea Flicker
Chris Farhood
Lint Roller
Scrubs McBarkley