fix(GRO-1173): remove stale .github/workflows/ci.yml

The .github/workflows/ci.yml targets ghcr.io and is replaced by
.gitea/workflows/ci.yml which targets git.farh.net with REGISTRY_TOKEN.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Dockerfile

@@ -14,7 +14,6 @@ FROM deps AS builder
 RUN mkdir -p /home/node/.cache/node/corepack
 COPY packages/ packages/
 COPY src/ src/
-COPY tsconfig.json ./
 RUN pnpm --filter @groombook/types build && \
     pnpm --filter @groombook/db build && \
     pnpm --filter @groombook/api build

UAT_PLAYBOOK.md

@@ -26,13 +26,14 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | # | Scenario | Steps | Expected |
 |---|----------|-------|----------|
 | TC-API-1.1 | Login via OIDC | POST to OIDC provider callback, verify JWT token issued | 200 OK, JWT returned with valid claims |
+| TC-API-1.2 | Session persistence | Make authenticated request, verify session token valid | 200 OK, request succeeds |
+| TC-API-1.3 | Logout | Call logout endpoint, verify token invalidated | 200 OK, subsequent requests return 401 |
 | TC-API-1.4 | Email+password login (UAT) | POST /api/auth/sign-in/email with uat-super@groombook.dev + SEED_UAT_SUPER_PASSWORD | 200 OK, session cookie returned |
 | TC-API-1.5 | Email+password login — groomer | POST /api/auth/sign-in/email with uat-groomer@groombook.dev + SEED_UAT_GROOMER_PASSWORD | 200 OK, session cookie returned |
 | TC-API-1.6 | Email+password login — customer | POST /api/auth/sign-in/email with uat-customer@groombook.dev + SEED_UAT_CUSTOMER_PASSWORD | 200 OK, session cookie returned |
 | TC-API-1.7 | Email+password login — tester | POST /api/auth/sign-in/email with uat-tester@groombook.dev + SEED_UAT_TESTER_PASSWORD | 200 OK, session cookie returned |
 | TC-API-1.8 | Email+password — invalid password | POST /api/auth/sign-in/email with wrong password | 400 Bad Request, error returned |
 | TC-API-1.9 | Email+password — unknown user | POST /api/auth/sign-in/email with non-existent email | 400 Bad Request, error returned |
-| TC-API-1.10 | Auto-provision on first OIDC login | First login as a Better-Auth user with no existing staff record | 200 OK, access granted; groomer staff record auto-created with name/email from user table |
 
 ### 4.2 Client Management
 
@@ -190,18 +191,6 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | TC-API-14.4 | Update group notes | PATCH /api/appointment-groups/{id} with notes | 200 OK, notes updated |
 | TC-API-14.5 | Cancel group | DELETE /api/appointment-groups/{id} | 200 OK, all appointments cancelled |
 
-### 4.15 Buffer Rules
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-15.1 | List buffer rules | GET /api/admin/buffer-rules | 200 OK, list of active buffer rules returned |
-| TC-API-15.2 | Create buffer rule | POST /api/admin/buffer-rules with service, species, sizeCategory, bufferMinutes | 201 Created, buffer rule created |
-| TC-API-15.3 | Update buffer rule | PATCH /api/admin/buffer-rules/{id} with updated bufferMinutes | 200 OK, buffer rule updated |
-| TC-API-15.4 | Delete buffer rule | DELETE /api/admin/buffer-rules/{id} | 200 OK, buffer rule removed |
-| TC-API-15.5 | Reject invalid bufferMinutes | POST /api/admin/buffer-rules with bufferMinutes: -5 | 400 Bad Request, invalid bufferMinutes rejected |
-| TC-API-15.6 | Reject missing required fields | POST /api/admin/buffer-rules with service only | 400 Bad Request, species and sizeCategory required |
-| TC-API-15.7 | Booking uses buffer | Book appointment for pet with sizeCategory; verify duration reflects buffer | 201 Created, appointment duration includes buffer time |
-
 ## Pass/Fail Criteria
 
 **Pass:**

apps/api/src/__tests__/petsExtendedFields.test.ts

@@ -0,0 +1,415 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { Hono } from "hono";
+import type { AppEnv, StaffRow } from "../middleware/rbac.js";
+import { petsRouter } from "../routes/pets.js";
+
+// ─── Mock staff fixtures ──────────────────────────────────────────────────────
+
+const MANAGER: StaffRow = {
+  id: "staff-manager-id",
+  oidcSub: "oidc-manager-sub",
+  userId: null,
+  role: "manager",
+  isSuperUser: true,
+  name: "Manager McManager",
+  email: "manager@example.com",
+  active: true,
+  icalToken: null,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+};
+
+// ─── Mutable mock state ───────────────────────────────────────────────────────
+
+const CLIENT_ID = "client-uuid-extended";
+const PET_ID = "pet-uuid-extended";
+
+let petRows: Record<string, unknown>[] = [];
+let appointmentRows: Record<string, unknown>[] = [];
+let insertedValues: Record<string, unknown>[] = [];
+let updatedValues: Record<string, unknown>[] = [];
+let deletedId: string | null = null;
+
+function resetMock() {
+  petRows = [{
+    id: PET_ID,
+    clientId: CLIENT_ID,
+    name: "Biscuit",
+    species: "dog",
+    breed: "Golden Retriever",
+    weightKg: "30.00",
+    dateOfBirth: null,
+    healthAlerts: null,
+    groomingNotes: null,
+    cutStyle: null,
+    shampooPreference: null,
+    specialCareNotes: null,
+    customFields: {},
+    photoKey: null,
+    photoUploadedAt: null,
+    image: null,
+    coatType: null,
+    temperamentScore: null,
+    temperamentFlags: [],
+    medicalAlerts: [],
+    preferredCuts: [],
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  }];
+  appointmentRows = [];
+  insertedValues = [];
+  updatedValues = [];
+  deletedId = null;
+}
+
+function makeSelectChainable(rows: unknown[]): unknown {
+  const chain = new Proxy([...rows], {
+    get(target, prop) {
+      if (prop === "where" || prop === "orderBy" || prop === "limit") {
+        return () => chain;
+      }
+      // @ts-expect-error proxy
+      return target[prop];
+    },
+  });
+  return chain;
+}
+
+function makeInsertChainable(): unknown {
+  let vals: Record<string, unknown> = {};
+  const chain = new Proxy({}, {
+    get(target, prop) {
+      if (prop === "values") {
+        return (v: Record<string, unknown>) => { vals = v; return chain; };
+      }
+      if (prop === "returning") {
+        return () => {
+          insertedValues.push(vals);
+          return [vals.id ? { ...vals, id: vals.id ?? PET_ID } : { ...vals, id: PET_ID }];
+        };
+      }
+      return chain;
+    },
+  });
+  return chain;
+}
+
+function makeUpdateChainable(): unknown {
+  let vals: Record<string, unknown> = {};
+  let whereId: string | null = null;
+  const chain = new Proxy({}, {
+    get(target, prop) {
+      if (prop === "set") {
+        return (v: Record<string, unknown>) => { vals = v; return chain; };
+      }
+      if (prop === "where") {
+        return (cond: unknown) => {
+          // Extract id from condition if it's an eq call
+          if (whereId) vals = { ...vals };
+          return chain;
+        };
+      }
+      if (prop === "returning") {
+        return () => {
+          const merged = { ...petRows[0], ...vals };
+          updatedValues.push(vals);
+          return [merged];
+        };
+      }
+      return chain;
+    },
+  });
+  return chain;
+}
+
+function makeDeleteChainable(): unknown {
+  let whereId: string | null = null;
+  const chain = new Proxy({}, {
+    get(target, prop) {
+      if (prop === "where") {
+        return (cond: unknown) => {
+          whereId = PET_ID;
+          return chain;
+        };
+      }
+      if (prop === "returning") {
+        return () => {
+          const row = petRows[0];
+          deletedId = row.id as string;
+          return [row];
+        };
+      }
+      return chain;
+    },
+  });
+  return chain;
+}
+
+vi.mock("../db", async (importOriginal) => {
+  const db = await importOriginal<typeof import("../db/index.js")>();
+  const pets = new Proxy({ _name: "pets" }, { get: (t, p) => p === "_name" ? "pets" : {} });
+  const appointments = new Proxy({ _name: "appointments" }, { get: (t, p) => p === "_name" ? "appointments" : {} });
+  return {
+    getDb: () => ({
+      select: () => ({
+        from: (table: unknown) => {
+          const name = (table as { _name?: string })._name;
+          if (name === "appointments") return makeSelectChainable(appointmentRows);
+          return makeSelectChainable(petRows);
+        },
+      }),
+      insert: () => makeInsertChainable(),
+      update: () => makeUpdateChainable(),
+      delete: () => makeDeleteChainable(),
+    }),
+    pets,
+    appointments,
+    and: db.and,
+    eq: db.eq,
+    exists: db.exists,
+    or: db.or,
+  };
+});
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeApp(staff: StaffRow = MANAGER) {
+  const app = new Hono<AppEnv>();
+  app.use("*", async (c, next) => {
+    c.set("staff", staff);
+    await next();
+  });
+  return app.route("/pets", petsRouter);
+}
+
+function createApp() {
+  const app = makeApp(MANAGER);
+  return app;
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("Extended pet profile fields — validation", () => {
+  beforeEach(resetMock);
+
+  it("rejects temperamentScore of 0 (below min)", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 0 }),
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.success).toBe(false);
+  });
+
+  it("rejects temperamentScore of 6 (above max)", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 6 }),
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.success).toBe(false);
+  });
+
+  it("rejects non-integer temperamentScore", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 3.5 }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects invalid medicalAlert severity", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        clientId: CLIENT_ID,
+        name: "Test",
+        species: "dog",
+        medicalAlerts: [{ type: "seizure", description: "xyz", severity: "critical" }],
+      }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("accepts valid temperamentScore 1–5", async () => {
+    const app = createApp();
+    for (const score of [1, 2, 3, 4, 5]) {
+      resetMock();
+      const res = await app.request("/pets", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: score }),
+      });
+      expect(res.status).toBe(201);
+    }
+  });
+
+  it("accepts all valid medicalAlert severity values", async () => {
+    const app = createApp();
+    for (const severity of ["low", "medium", "high"] as const) {
+      resetMock();
+      const res = await app.request("/pets", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          clientId: CLIENT_ID,
+          name: "Test",
+          species: "dog",
+          medicalAlerts: [{ type: "allergy", description: "Sensitive to chicken", severity }],
+        }),
+      });
+      expect(res.status).toBe(201);
+    }
+  });
+});
+
+describe("Extended pet profile fields — create", () => {
+  beforeEach(resetMock);
+
+  it("accepts all extended fields on create", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        clientId: CLIENT_ID,
+        name: "Biscuit",
+        species: "dog",
+        breed: "Golden Retriever",
+        coatType: "double",
+        temperamentScore: 4,
+        temperamentFlags: ["anxious_with_dryers", "gentle"],
+        medicalAlerts: [
+          { type: "seizure", description: "Occasional episodes", severity: "medium" },
+        ],
+        preferredCuts: ["puppy cut", "teddy bear"],
+      }),
+    });
+    expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(body.coatType).toBe("double");
+    expect(body.temperamentScore).toBe(4);
+    expect(body.temperamentFlags).toEqual(["anxious_with_dryers", "gentle"]);
+    expect(body.medicalAlerts).toEqual([{ type: "seizure", description: "Occasional episodes", severity: "medium" }]);
+    expect(body.preferredCuts).toEqual(["puppy cut", "teddy bear"]);
+  });
+
+  it("create without extended fields works (all optional)", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Basil", species: "cat" }),
+    });
+    expect(res.status).toBe(201);
+  });
+});
+
+describe("Extended pet profile fields — update", () => {
+  beforeEach(resetMock);
+
+  it("updates coatType", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ coatType: "double" }),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.coatType).toBe("double");
+  });
+
+  it("updates temperamentScore", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ temperamentScore: 2 }),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.temperamentScore).toBe(2);
+  });
+
+  it("rejects temperamentScore 0 on update", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ temperamentScore: 0 }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects invalid severity on update", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        medicalAlerts: [{ type: "x", description: "y", severity: "urgent" }],
+      }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects too many temperamentFlags (>20)", async () => {
+    const app = createApp();
+    const flags = Array.from({ length: 21 }, (_, i) => `flag_${i}`);
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentFlags: flags }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects too many preferredCuts (>20)", async () => {
+    const app = createApp();
+    const cuts = Array.from({ length: 21 }, (_, i) => `cut_${i}`);
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", preferredCuts: cuts }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects too many medicalAlerts (>50)", async () => {
+    const app = createApp();
+    const alerts = Array.from({ length: 51 }, (_, i) => ({
+      type: `type_${i}`,
+      description: `desc_${i}`,
+      severity: "low" as const,
+    }));
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", medicalAlerts: alerts }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("returns extended fields in GET response", async () => {
+    petRows = [{ ...petRows[0], coatType: "wire", temperamentScore: 3, temperamentFlags: ["gentle"], medicalAlerts: [], preferredCuts: ["scissor cut"] }];
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.coatType).toBe("wire");
+    expect(body.temperamentScore).toBe(3);
+    expect(body.temperamentFlags).toEqual(["gentle"]);
+    expect(body.preferredCuts).toEqual(["scissor cut"]);
+  });
+});

apps/api/src/__tests__/rbac.test.ts

@@ -45,76 +45,40 @@ const GROOMER: StaffRow = {
 
 let staffLookupResult: StaffRow | null = null;
 let managerFallbackResult: StaffRow | null = MANAGER;
-let userLookupResult: { id: string; name: string | null; email: string | null } | null = null;
-let _insertedStaff: StaffRow | null = null;
 
 vi.mock("../db", () => {
-  const makeTableProxy = (name: string) =>
-    new Proxy(
-      { _name: name },
-      {
-        get(target, prop) {
-          if (prop === "_name") return name;
-          if (prop === "$inferSelect") return {};
-          return { table: name, column: prop };
-        },
-      }
-    );
-
-  const staff = makeTableProxy("staff");
-  const user = makeTableProxy("user");
-
-  const buildQuery = (result: unknown, fallback: unknown) => ({
-    [Symbol.iterator]: function* () {
-      if (result) yield result;
-    },
-    limit: (_n: number) => {
-      const item = result ?? fallback;
-      return {
-        [Symbol.iterator]: function* () { if (item) yield item; },
-        0: item,
-        length: item ? 1 : 0,
-      };
-    },
-  });
+  const staff = new Proxy(
+    { _name: "staff" },
+    {
+      get(target, prop) {
+        if (prop === "_name") return "staff";
+        if (prop === "$inferSelect") return {};
+        return { table: "staff", column: prop };
+      },
+    }
+  );
 
   return {
     getDb: () => ({
       select: () => ({
-        from: (table: unknown) => ({
-          where: () => buildQuery(
-            table === staff ? staffLookupResult : userLookupResult,
-            table === staff ? managerFallbackResult : null
-          ),
-        }),
-      }),
-      insert: (_table: unknown) => ({
-        values: (vals: Record<string, unknown>) => ({
-          returning: () => {
-            const newStaff: StaffRow = {
-              id: "new-staff-id",
-              oidcSub: null,
-              userId: vals.userId as string,
-              role: vals.role as StaffRow["role"],
-              isSuperUser: false,
-              name: vals.name as string,
-              email: vals.email as string,
-              active: true,
-              icalToken: null,
-              createdAt: new Date(),
-              updatedAt: new Date(),
-            };
-            _insertedStaff = newStaff;
-            return [newStaff];
-          },
+        from: () => ({
+          where: () => ({
+            limit: () => {
+              // dev mode fallback to first manager
+              return managerFallbackResult ? [managerFallbackResult] : [];
+            },
+            [Symbol.iterator]: function* () {
+              if (staffLookupResult) yield staffLookupResult;
+            },
+            0: staffLookupResult,
+            length: staffLookupResult ? 1 : 0,
+          }),
         }),
       }),
     }),
     staff,
-    user,
     eq: vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val })),
     and: vi.fn((..._clauses: unknown[]) => ({})),
-    sql: vi.fn((..._args: unknown[]) => ({})),
   };
 });
 
@@ -123,8 +87,6 @@ vi.mock("../db", () => {
 function resetMocks() {
   staffLookupResult = null;
   managerFallbackResult = MANAGER;
-  userLookupResult = null;
-  _insertedStaff = null;
 }
 
 /** Build a minimal Hono app with jwtPayload pre-set, then apply a middleware. */
@@ -134,10 +96,7 @@ function buildApp(
 ) {
   const app = new Hono<AppEnv>();
   app.use("*", async (c, next) => {
-    c.set("jwtPayload", {
-      sub: userLookupResult?.id ?? staffLookupResult?.userId ?? "unknown-sub",
-      email: userLookupResult?.email,
-    });
+    c.set("jwtPayload", { sub: staffLookupResult?.userId ?? "unknown-sub" });
     await next();
   });
   app.use("*", middleware);
@@ -243,50 +202,6 @@ describe("resolveStaffMiddleware", () => {
     const body = await res.json();
     expect(body.error).toMatch(/no staff records found/i);
   });
-
-  it("auto-provision: creates groomer staff record on first login when Better-Auth user exists", async () => {
-    staffLookupResult = null;
-    userLookupResult = { id: "ba-user-new", name: "New User", email: "newuser@example.com" };
-    let capturedStaff: StaffRow | null = null;
-    const app = buildApp(resolveStaffMiddleware, (c) => {
-      capturedStaff = c.get("staff");
-      return c.json({ ok: true });
-    });
-
-    const res = await app.request("/test");
-    expect(res.status).toBe(200);
-    expect(capturedStaff).not.toBeNull();
-    expect(capturedStaff!.role).toBe("groomer");
-    expect(capturedStaff!.userId).toBe("ba-user-new");
-    expect(capturedStaff!.name).toBe("New User");
-    expect(capturedStaff!.email).toBe("newuser@example.com");
-    expect(capturedStaff!.isSuperUser).toBe(false);
-  });
-
-  it("auto-provision: falls back to email prefix when user has no name", async () => {
-    staffLookupResult = null;
-    userLookupResult = { id: "ba-user-noname", name: null, email: "firstlogin@example.com" };
-    let capturedStaff: StaffRow | null = null;
-    const app = buildApp(resolveStaffMiddleware, (c) => {
-      capturedStaff = c.get("staff");
-      return c.json({ ok: true });
-    });
-
-    const res = await app.request("/test");
-    expect(res.status).toBe(200);
-    expect(capturedStaff!.name).toBe("firstlogin");
-  });
-
-  it("auto-provision: returns 403 when no staff record and no Better-Auth user exists", async () => {
-    staffLookupResult = null;
-    userLookupResult = null;
-    const app = buildApp(resolveStaffMiddleware);
-
-    const res = await app.request("/test");
-    expect(res.status).toBe(403);
-    const body = await res.json();
-    expect(body.error).toMatch(/no staff record found for authenticated user/i);
-  });
 });
 
 // ─── requireRole tests ────────────────────────────────────────────────────────

apps/api/src/middleware/rbac.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff, user } from "../db/index.js";
+import { and, eq, getDb, sql, staff } from "../db/index.js";
 
 export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
@@ -110,33 +110,6 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
       return;
     }
   }
-  // Auto-provision: no staff record exists for this user at all, but a valid
-  // Better-Auth user session exists (jwt.sub = user.id from user table).
-  // Create a minimal groomer staff record on first login.
-  const [userRow] = await db
-    .select({ id: user.id, name: user.name, email: user.email })
-    .from(user)
-    .where(eq(user.id, jwt.sub))
-    .limit(1);
-  if (userRow) {
-    const [newStaff] = await db
-      .insert(staff)
-      .values({
-        name: userRow.name ?? jwt.email?.split("@")[0] ?? "Unknown",
-        email: userRow.email ?? jwt.email ?? "",
-        userId: jwt.sub,
-        role: "groomer",
-        isSuperUser: false,
-        active: true,
-      })
-      .returning();
-    if (!newStaff) {
-      return c.json({ error: "Internal error: staff record creation failed" }, 500);
-    }
-    c.set("staff", newStaff);
-    await next();
-    return;
-  }
   return c.json(
     { error: "Forbidden: no staff record found for authenticated user" },
     403

packages/db/migrations/0031_buffer_rules.sql

@@ -1,31 +0,0 @@
--- Migration: 0031_buffer_rules.sql
--- Buffer rules CRUD: pet size/coat enums, bufferRules table, services.defaultBufferMinutes
-
--- ─── Enums ───────────────────────────────────────────────────────────────────
-
-CREATE TYPE "pet_size_category" AS ENUM ('small', 'medium', 'large', 'xlarge');
-CREATE TYPE "coat_type" AS ENUM ('smooth', 'double', 'wire', 'curly', 'long', 'hairless');
-
--- ─── Alter pets columns to use new enums ─────────────────────────────────────
-
-ALTER TABLE "pets" ALTER COLUMN "coat_type" TYPE "coat_type" USING "coat_type"::text::"coat_type";
-ALTER TABLE "pets" ALTER COLUMN "pet_size_category" TYPE "pet_size_category" USING "pet_size_category"::text::"pet_size_category";
-
--- ─── Services: add defaultBufferMinutes ───────────────────────────────────────
-
-ALTER TABLE "services" ADD COLUMN "default_buffer_minutes" integer;
-
--- ─── Buffer Rules table ───────────────────────────────────────────────────────
-
-CREATE TABLE "buffer_rules" (
-  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  "service_id" uuid NOT NULL REFERENCES "services"("id") ON DELETE CASCADE,
-  "size_category" "pet_size_category",
-  "coat_type" "coat_type",
-  "buffer_minutes" integer NOT NULL,
-  "created_at" timestamp NOT NULL DEFAULT now(),
-  "updated_at" timestamp NOT NULL DEFAULT now(),
-  CONSTRAINT "uq_buffer_rules_service_size_coat" UNIQUE ("service_id", "size_category", "coat_type")
-);
-
-CREATE INDEX "idx_buffer_rules_service_id" ON "buffer_rules"("service_id");

packages/db/package.json

@@ -25,7 +25,6 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "better-auth": "^1.5.6",
     "drizzle-orm": "^0.38.4",
     "postgres": "^3.4.5"
   },

packages/db/src/factories.ts

@@ -105,8 +105,6 @@ export function buildPet(overrides: Partial<PetRow> & { clientId: string }): Pet
     photoKey: null,
     photoUploadedAt: null,
     image: null,
-    coatType: null,
-    petSizeCategory: null,
     createdAt: new Date("2025-01-01T00:00:00Z"),
     updatedAt: new Date("2025-01-01T00:00:00Z"),
   };
@@ -121,7 +119,6 @@ export function buildService(overrides: Partial<ServiceRow> = {}): ServiceRow {
     description: "A grooming service",
     basePriceCents: 6500,
     durationMinutes: 60,
-    defaultBufferMinutes: null,
     active: true,
     createdAt: new Date("2025-01-01T00:00:00Z"),
     updatedAt: new Date("2025-01-01T00:00:00Z"),

packages/db/src/schema.ts

@@ -48,22 +48,6 @@ export const clientStatusEnum = pgEnum("client_status", [
   "disabled",
 ]);
 
-export const petSizeCategoryEnum = pgEnum("pet_size_category", [
-  "small",
-  "medium",
-  "large",
-  "xlarge",
-]);
-
-export const coatTypeEnum = pgEnum("coat_type", [
-  "smooth",
-  "double",
-  "wire",
-  "curly",
-  "long",
-  "hairless",
-]);
-
 // ─── Better-Auth Tables ──────────────────────────────────────────────────────
 
 export const user = pgTable("user", {
@@ -158,8 +142,8 @@ export const pets = pgTable(
     cutStyle: text("cut_style"),
     shampooPreference: text("shampoo_preference"),
     specialCareNotes: text("special_care_notes"),
-    coatType: coatTypeEnum("coat_type"),
-    petSizeCategory: petSizeCategoryEnum("pet_size_category"),
+    coatType: text("coat_type"),
+    petSizeCategory: text("pet_size_category"),
     customFields: jsonb("custom_fields").$type<Record<string, string>>().notNull().default({}),
     photoKey: text("photo_key"),
     photoUploadedAt: timestamp("photo_uploaded_at"),
@@ -176,34 +160,11 @@ export const services = pgTable("services", {
   description: text("description"),
   basePriceCents: integer("base_price_cents").notNull(),
   durationMinutes: integer("duration_minutes").notNull(),
-  defaultBufferMinutes: integer("default_buffer_minutes"),
   active: boolean("active").notNull().default(true),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });
 
-export const bufferRules = pgTable(
-  "buffer_rules",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    serviceId: uuid("service_id")
-      .notNull()
-      .references(() => services.id, { onDelete: "cascade" }),
-    sizeCategory: petSizeCategoryEnum("size_category"),
-    coatType: coatTypeEnum("coat_type"),
-    bufferMinutes: integer("buffer_minutes").notNull(),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-  },
-  (t) => [
-    unique("uq_buffer_rules_service_size_coat").on(
-      t.serviceId,
-      t.sizeCategory,
-      t.coatType
-    ),
-  ]
-);
-
 export const staff = pgTable("staff", {
   id: uuid("id").primaryKey().defaultRandom(),
   name: text("name").notNull(),

packages/db/src/seed.ts

@@ -18,7 +18,7 @@
 
 import postgres from "postgres";
 import { drizzle } from "drizzle-orm/postgres-js";
-import { eq, and, sql } from "drizzle-orm";
+import { eq, sql } from "drizzle-orm";
 import * as schema from "./schema.js";
 
 // ── Seed profile configuration ─────────────────────────────────────────────
@@ -490,90 +490,6 @@ async function seedKnownUsers() {
     }
   }
 
-  // ── Better-Auth email+password credentials for UAT accounts ──────────────────
-  // Provisions Better-Auth user + account records so UAT testers can log in
-  // via email+password (POST /api/auth/sign-in/email) instead of Authentik SSO.
-  const uatPasswordAccounts = [
-    { email: "uat-super@groombook.dev", name: "UAT Super User", passwordEnv: "SEED_UAT_SUPER_PASSWORD", staffEmail: "uat-super@groombook.dev" },
-    { email: "uat-groomer@groombook.dev", name: "UAT Staff Groomer", passwordEnv: "SEED_UAT_GROOMER_PASSWORD", staffEmail: "uat-groomer@groombook.dev" },
-    { email: "uat-customer@groombook.dev", name: "UAT Customer", passwordEnv: "SEED_UAT_CUSTOMER_PASSWORD", staffEmail: null },
-    { email: "uat-tester@groombook.dev", name: "UAT Tester", passwordEnv: "SEED_UAT_TESTER_PASSWORD", staffEmail: "uat-tester@groombook.dev" },
-  ];
-
-  for (const acct of uatPasswordAccounts) {
-    const password = process.env[acct.passwordEnv];
-    if (!password) {
-      console.warn(`⚠ Skipping ${acct.email} — ${acct.passwordEnv} not set`);
-      continue;
-    }
-
-    // 1. Find or create the Better-Auth user
-    const [existingUser] = await db
-      .select()
-      .from(schema.user)
-      .where(eq(schema.user.email, acct.email))
-      .limit(1);
-
-    let userId: string;
-    if (existingUser) {
-      userId = existingUser.id;
-      console.log(`✓ Better-Auth user '${acct.name}' already exists — skipping user creation`);
-    } else {
-      userId = uuid();
-      await db.insert(schema.user).values({
-        id: userId,
-        name: acct.name,
-        email: acct.email,
-        emailVerified: true,
-      });
-      console.log(`✓ Created Better-Auth user '${acct.name}' (${acct.email})`);
-    }
-
-    // 2. Check if credential account already exists
-    const [existingAccount] = await db
-      .select()
-      .from(schema.account)
-      .where(and(
-        eq(schema.account.userId, userId),
-        eq(schema.account.providerId, "credential")
-      ))
-      .limit(1);
-
-    if (existingAccount) {
-      console.log(`✓ Credential account for '${acct.email}' already exists — skipping`);
-    } else {
-      // Use Better-Auth's own hashPassword so the hash format matches what
-      // better-auth validates at sign-in time.
-      // better-auth/crypto uses: N=16384, r=16, p=1, dkLen=64.
-      const { hashPassword } = await import("better-auth/crypto");
-      const passwordHash = await hashPassword(password);
-
-      await db.insert(schema.account).values({
-        id: uuid(),
-        accountId: userId,
-        providerId: "credential",
-        userId,
-        password: passwordHash,
-      });
-      console.log(`✓ Created credential account for '${acct.email}'`);
-    }
-
-    // 3. Link staff record to Better-Auth user (for accounts that have staff records)
-    if (acct.staffEmail) {
-      const [existingStaff] = await db
-        .select()
-        .from(schema.staff)
-        .where(eq(schema.staff.email, acct.staffEmail))
-        .limit(1);
-      if (existingStaff && !existingStaff.userId) {
-        await db.update(schema.staff)
-          .set({ userId })
-          .where(eq(schema.staff.id, existingStaff.id));
-        console.log(`✓ Linked staff '${acct.staffEmail}' → Better-Auth user`);
-      }
-    }
-  }
-
   // ── Services: idempotent upsert using name as unique key ─────────────────────
   // UNIQUE constraint on services.name (migration 0020) must exist first.
   // Uses b0000001-... IDs to match main seed servicesDef for same-named services.

src/index.ts

@@ -19,7 +19,6 @@ import { impersonationRouter } from "./routes/impersonation.js";
 import { settingsRouter } from "./routes/settings.js";
 import { authProviderRouter } from "./routes/authProvider.js";
 import { searchRouter } from "./routes/search.js";
-import { bufferRulesRouter } from "./routes/buffer-rules.js";
 import { getObject } from "./lib/s3.js";
 import { calendarRouter } from "./routes/calendar.js";
 import { setupRouter } from "./routes/setup.js";
@@ -270,7 +269,6 @@ api.route("/admin/settings", settingsRouter);
 api.route("/admin/auth-provider", authProviderRouter);
 api.route("/admin/seed", adminSeedRouter);
 api.route("/search", searchRouter);
-api.route("/buffer-rules", bufferRulesRouter);
 
 const port = Number(process.env.PORT ?? 3000);
 await initAuth();

src/routes/book.ts

@@ -193,8 +193,8 @@ bookRouter.post(
         name: body.petName,
         species: body.petSpecies,
         breed: body.petBreed ?? null,
-        coatType: (body.petCoatType ?? null) as "smooth" | "double" | "wire" | "curly" | "long" | "hairless" | null,
-        petSizeCategory: (body.petSizeCategory ?? null) as "small" | "medium" | "large" | "xlarge" | null,
+        coatType: body.petCoatType ?? null,
+        petSizeCategory: body.petSizeCategory ?? null,
       })
       .returning();
     const pet = petInserted[0];

src/routes/buffer-rules.ts

@@ -1,128 +0,0 @@
-import { Hono } from "hono";
-import { zValidator } from "@hono/zod-validator";
-import { z } from "zod/v3";
-import {
-  and,
-  eq,
-  isNull,
-  getDb,
-  bufferRules,
-  services,
-} from "@groombook/db";
-import type { AppEnv } from "../middleware/rbac.js";
-import { requireRole } from "../middleware/rbac.js";
-
-export const bufferRulesRouter = new Hono<AppEnv>();
-
-// Apply manager role guard to all routes
-bufferRulesRouter.use("*", requireRole("manager"));
-
-const createBufferRuleSchema = z.object({
-  serviceId: z.string().uuid(),
-  sizeCategory: z.enum(["small", "medium", "large", "xlarge"]).optional(),
-  coatType: z.enum(["smooth", "double", "wire", "curly", "long", "hairless"]).optional(),
-  bufferMinutes: z.number().int().positive(),
-});
-
-const updateBufferRuleSchema = z.object({
-  bufferMinutes: z.number().int().positive(),
-});
-
-bufferRulesRouter.get("/", async (c) => {
-  const db = getDb();
-  const serviceId = c.req.query("serviceId");
-
-  const conditions = [];
-  if (serviceId) conditions.push(eq(bufferRules.serviceId, serviceId));
-
-  const rows = await db
-    .select({
-      id: bufferRules.id,
-      serviceId: bufferRules.serviceId,
-      serviceName: services.name,
-      sizeCategory: bufferRules.sizeCategory,
-      coatType: bufferRules.coatType,
-      bufferMinutes: bufferRules.bufferMinutes,
-      createdAt: bufferRules.createdAt,
-      updatedAt: bufferRules.updatedAt,
-    })
-    .from(bufferRules)
-    .leftJoin(services, eq(bufferRules.serviceId, services.id))
-    .where(conditions.length > 0 ? and(...conditions) : undefined);
-
-  return c.json(rows);
-});
-
-bufferRulesRouter.post(
-  "/",
-  zValidator("json", createBufferRuleSchema),
-  async (c) => {
-    const db = getDb();
-    const body = c.req.valid("json");
-
-    // Validate serviceId exists
-    const [svc] = await db
-      .select({ id: services.id })
-      .from(services)
-      .where(eq(services.id, body.serviceId))
-      .limit(1);
-    if (!svc) return c.json({ error: "Service not found" }, 404);
-
-    // Check for duplicate — sizeCategory/coatType are nullable, use isNull for null check
-    const conditions = [eq(bufferRules.serviceId, body.serviceId)];
-    if (body.sizeCategory) {
-      conditions.push(eq(bufferRules.sizeCategory, body.sizeCategory));
-    } else {
-      conditions.push(isNull(bufferRules.sizeCategory));
-    }
-    if (body.coatType) {
-      conditions.push(eq(bufferRules.coatType, body.coatType));
-    } else {
-      conditions.push(isNull(bufferRules.coatType));
-    }
-    const [existing] = await db
-      .select({ id: bufferRules.id })
-      .from(bufferRules)
-      .where(and(...conditions))
-      .limit(1);
-    if (existing) return c.json({ error: "Duplicate rule for this service and attributes" }, 409);
-
-    const [row] = await db
-      .insert(bufferRules)
-      .values({
-        serviceId: body.serviceId,
-        sizeCategory: body.sizeCategory,
-        coatType: body.coatType,
-        bufferMinutes: body.bufferMinutes,
-      })
-      .returning();
-
-    return c.json(row, 201);
-  }
-);
-
-bufferRulesRouter.patch(
-  "/:id",
-  zValidator("json", updateBufferRuleSchema),
-  async (c) => {
-    const db = getDb();
-    const body = c.req.valid("json");
-    const [row] = await db
-      .update(bufferRules)
-      .set({ bufferMinutes: body.bufferMinutes, updatedAt: new Date() })
-      .where(eq(bufferRules.id, c.req.param("id")))
-      .returning();
-    if (!row) return c.json({ error: "Not found" }, 404);
-    return c.json(row);
-  }
-);
-
-bufferRulesRouter.delete("/:id", async (c) => {
-  const db = getDb();
-  const [row] = await db
-    .delete(bufferRules)
-    .where(eq(bufferRules.id, c.req.param("id")))
-    .returning();
-  if (!row) return c.json({ error: "Not found" }, 404);
-  return c.json({ ok: true });
-});

src/routes/pets.ts

@@ -24,8 +24,6 @@ const createPetSchema = z.object({
   shampooPreference: z.string().max(500).optional(),
   specialCareNotes: z.string().max(2000).optional(),
   customFields: z.record(z.string(), z.string()).optional(),
-  sizeCategory: z.enum(["small", "medium", "large", "xlarge"]).optional(),
-  coatType: z.enum(["smooth", "double", "wire", "curly", "long", "hairless"]).optional(),
 });
 
 const updatePetSchema = createPetSchema.partial().omit({ clientId: true });

src/routes/services.ts

@@ -10,7 +10,6 @@ const createServiceSchema = z.object({
   description: z.string().max(2000).optional(),
   basePriceCents: z.number().int().positive(),
   durationMinutes: z.number().int().positive().max(480),
-  defaultBufferMinutes: z.number().int().min(0).optional(),
   active: z.boolean().default(true),
 });