The root pnpm scripts typecheck/lint/test the stale src/ directory.
Use pnpm --filter @groombook/api to target the correct apps/api/ path,
matching the GitHub Actions CI configuration.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The schema file had two sets of these enum declarations with different values.
The first (stale) set broke all tests importing @groombook/db via the vitest alias,
causing CI to fail and blocking the docker build job.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Dockerfile: keep node:22-alpine for both base and runner stages
- package.json: keep dev's full content + add packageManager field
- .gitea/workflows/ci.yml: keep fixed version with all 4 image targets
- petsExtendedFields.test.ts: keep dev UUIDs + PR's vi.fn() mocks
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Fix CLIENT_ID/PET_ID in petsExtendedFields.test.ts to valid UUIDs so
createPetSchema validation (z.string().uuid()) passes in tests
- Replace top-level imports of and/eq/exists/or with vi.fn() stubs in
petsExtendedFields.test.ts mock to avoid vi.mock hoisting ReferenceError
- Add impersonationAuditLogs proxy + insert() chain to portal.test.ts mock
to fix audit-log write failures
- Add 5 missing extended fields to buildPet factory defaults
- Add non-null assertion on petRows[0] in makeDeleteChainable
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- petsExtendedFields.test.ts: import and/eq/exists/or from db/index.js
(avoids mock scope collision with TypeScript closures)
- petsExtendedFields.test.ts: add non-null assertion on petRows[0]
in makeDeleteChainable (petRows always has at least one element)
- factories.ts buildPet: add missing extended pet fields to defaults
(coatType, temperamentScore, temperamentFlags, medicalAlerts,
preferredCuts) so the inferred PetRow type is satisfied
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Upgrade CI jobs (lint-typecheck, test, build) to Node 22
- Dockerfile uses node:22-alpine for base and runner stages
- Root package.json gets packageManager field for corepack pin
- Docker build already targets all 4 stages (api/migrate/seed/reset)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
ERR_PNPM_OUTDATED_LOCKFILE — specifiers in lockfile did not match
packages/db/package.json after better-auth upgrade.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Betters Auth v1.5.6 link-account.mjs:22 rejects OAuth callbacks when the
genericOAuth provider is not in trustedProviders AND email_verified is
falsy. Adding authentik to trustedProviders bypasses this guard so OIDC
login works for TF-created users whose emails were never verified through
an authentik flow.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The vi.mock factory uses db.and/eq/exists/or from the imported module,
but TypeScript's module-level import binding (const declarations)
can't be referenced inside the async factory before initialization.
Adding top-level imports from "../db/index.js" and using them
directly in the mock return fixes the TDZ error.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
1. Fix vi.mock factory: importOriginal -> db.and/eq/exists/or stubs
(removes ReferenceError from undeclared imports in test)
2. Remove MedicalAlert.id — not in schema/migration/DB, only in types
3. Replace z.string().max(100) coatType with z.enum for CoatType union
4. Fix test expecting coatType "smooth" (invalid) -> "double" (valid)
5. Add TC-API-3.8 through TC-API-3.15 to UAT_PLAYBOOK.md §4.3
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add TC-API-1.11 through TC-API-1.15 covering existing staff unaffected by
OIDC login, auto-provisioned role/superUser flags, and name fallback
variants (name present, no name+email present, no name+no email).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
1. Fix vi.mock factory: importOriginal -> db.and/eq/exists/or stubs
(removes ReferenceError from undeclared imports in test)
2. Remove MedicalAlert.id — not in schema/migration/DB, only in types
3. Replace z.string().max(100) coatType with z.enum for CoatType union
4. Fix test expecting coatType "smooth" (invalid) -> "double" (valid)
5. Add TC-API-3.8 through TC-API-3.15 to UAT_PLAYBOOK.md §4.3
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(GRO-1272): auto-provision staff record on first OIDC login (#19)
Fixes HTTP 403 on all authenticated routes for new OIDC users by auto-creating
a minimal groomer staff record on first login when a Better-Auth user exists
but no staff record is found.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
GRO-1325 was marked done but never implemented. This adds the missing
Better-Auth user + account seeding for UAT email+password logins.
For each SEED_UAT_*_PASSWORD env var present, the seed now:
1. Creates (or links to existing) a Better-Auth user record with
emailVerified: true
2. Creates a credential account with providerId: "credential"
and a bcrypt-hashed password (using better-auth/crypto)
3. Links the staff record to the Better-Auth user via userId
Idempotent: skips user/account creation if already seeded.
Updated UAT_PLAYBOOK.md §4.1 — TC-API-1.4 through 1.9 now reference
the new seed provisioning (GRO-1325 was the missing piece).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Re-implement lost commit from worktree cleanup. PR #12 already has
UAT_PLAYBOOK + factories fix; add all missing core implementation:
- Add petSizeCategoryEnum/coatTypeEnum to schema
- Add bufferRules table with service FK + unique constraint
- Add defaultBufferMinutes column to services table
- Change pets.coatType/petSizeCategory text columns to use enums
- Add routes/buffer-rules.ts: GET/POST/PATCH/DELETE, manager role guard
- Register /api/buffer-rules in index.ts
- Update services.ts PATCH to accept defaultBufferMinutes
- Update pets.ts POST/PATCH to accept sizeCategory/coatType
- Cast coatType/petSizeCategory in book.ts insert to match new enums
- Add 0031_buffer_rules.sql migration
- Fix factories.ts buildService to include defaultBufferMinutes: null
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Address QA review findings on PR #12:
- Add coatType and petSizeCategory to buildPet defaults in packages/db/src/factories.ts
to fix TypeScript typecheck failure
- Restore UAT_PLAYBOOK.md (was deleted during monorepo extraction) and add
§4.15 Buffer Rules test cases
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Sync api packages/types with web workspace — add MedicalAlert, AlertSeverity,
CoatType, preferredCuts, medicalAlerts, temperamentScore, temperamentFlags.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add petSizeCategory and petCoatType to bookingSchema zod validator (optional)
- Save coatType to pets row on booking creation
- Add coatType and petSizeCategory columns to pets DB schema
- Add coatType and petSizeCategory to Pet interface in @groombook/types
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Two pre-existing bugs prevented petsExtendedFields.test.ts from running:
1. vi.mock factory referenced bare `and`, `eq`, `exists`, `or` variables
that are undefined at hoist time — replaced with inline mock functions
2. CLIENT_ID/PET_ID used non-UUID strings but Zod schema requires uuid()
All 36 test files (521 tests) now pass.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add drizzle-orm ^0.38.4 and postgres ^3.4.5 to root package.json
dependencies so that pnpm --frozen-lockfile install in CI makes
them available at the root node_modules level.
apps/api is not a pnpm workspace member (workspace declares
packages: ["apps/*"]), so CI's pnpm install does not reach into
apps/api/node_modules/. Adding these deps to the root package.json
fixes the ERR_MODULE_NOT_FOUND error that Vitest encountered when
running tests under pnpm --frozen-lockfile.
Also moves drizzle-orm and postgres from apps/api/devDependencies
to dependencies per the issue spec.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Rename insertedStaff to _insertedStaff (ESLint unused var, line 49)
- Rename table param to _table in insert mock (ESLint unused param, line 91)
- Fix buildApp jwtPayload to prefer userLookupResult.id over staffLookupResult.userId
(corrects auto-provision test failures where sub was 'unknown-sub' instead of 'ba-user-new')
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add null guard for newStaff after .returning() in auto-provision block
- Make buildQuery() iterable without .limit() call (for WHERE-only queries)
- Use fallback in .limit() for manager-fallback dev-mode tests
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add user table mock and db.insert returning chain to rbac.test.ts
- Add three new tests: happy-path auto-provision, email-prefix fallback,
and miss-path (no user → 403)
- Add TC-API-1.4 to UAT_PLAYBOOK.md §4.1 for first-login auto-provision
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
When a user authenticates via OIDC but has no staff record (userId NULL,
oidcSub mismatch, email mismatch), resolveStaffMiddleware now checks for
a Better-Auth user record by jwt.sub and auto-creates a minimal groomer
staff record on first login.
This fixes the UAT regression where all API routes returned 403 for all
authenticated users after GRO-1207, because seedKnownUsers() sets
oidcSub to Authentik integer PKs or emails rather than the actual Authentik
OIDC sub (a UUID). The auto-provision path bridges the gap for all UAT
personas without requiring seed/Terraform changes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Merges the dev branch history into gitea/migrate-workflows to resolve
PR #24. The two branches had unrelated git histories due to the Gitea
migration. Conflict resolution favors gitea/migrate-workflows for
packages/, src/, .gitea/ structure and dev for apps/, .github/ content.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use pnpm --filter consistently for all three package builds in the
Dockerfile instead of mixing filter and cd approaches. Also set
--project . explicitly on tsc invocations to ensure tsconfig resolution
from the package directory rather than workspace root.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
tsc -p /app does not resolve to tsconfig.json at /app/tsconfig.json
without an explicit filename. Pass the full path.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
When pnpm --filter runs the api package build, tsc cannot find the
tsconfig.json. Use an absolute path to avoid any ambiguity about the
working directory context.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Both -p . and --project . should be equivalent, but the Docker build
appears to resolve them differently. Use -p for consistency.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
pnpm --filter runs in the workspace root where tsc finds the root
tsconfig.json instead of packages/db/tsconfig.json. Change into the
package directory so tsc picks up the correct local tsconfig.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
tsc without --project traverses up to workspace root, which has a
different tsconfig.json that lacks package-local paths. Fix both
@groombook/types and @groombook/db scripts consistently.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
tsc without --project flag picks up tsconfig.json from the workspace
root, which lacks the packages/* paths needed for the monorepo build.
Explicit --project . ensures tsc uses the local tsconfig.json.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Chris Farhood
The Dogfather
Flea Flicker
Flea Flicker
Lint Roller