Merge pull request 'chore: promote dev → uat (GRO-1544 health endpoint fix)' (#59) from dev into uat

chore: promote dev → uat (GRO-1544 health endpoint fix)

Merge dev → uat. CI auto-deploys to UAT environment.

.gitea/workflows/ci.yml

@@ -78,8 +78,6 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
 
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
@@ -95,7 +93,6 @@ jobs:
           file: Dockerfile
           target: runner
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
@@ -109,7 +106,6 @@ jobs:
           file: Dockerfile
           target: migrate
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }}
@@ -123,7 +119,6 @@ jobs:
           file: Dockerfile
           target: seed
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/seed:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }}
@@ -137,7 +132,6 @@ jobs:
           file: Dockerfile
           target: reset
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/reset:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }}

UAT_PLAYBOOK.md

@@ -139,9 +139,6 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | TC-API-8.5 | Add waitlist entry | POST /api/portal/waitlist with pet and service | 201 Created, waitlist entry created |
 | TC-API-8.6 | View portal invoices | GET /api/portal/invoices | 200 OK, list of client's invoices returned |
 | TC-API-8.7 | Pay multiple invoices | POST /api/portal/invoices/pay-multiple with invoice IDs | 200 OK, payment intent created |
-| TC-API-8.8 | Update pet profile | PATCH /api/portal/pets/{id} with name, breed, groomingNotes | 200 OK, pet updated in portal shape |
-| TC-API-8.9 | Update pet — ownership check | PATCH /api/portal/pets/{id} with session for different client | 403 Forbidden, pet belongs to another client |
-| TC-API-8.10 | Update pet — not found | PATCH /api/portal/pets/{nonexistent-id} | 404 Not Found |
 
 ### 4.9 Waitlist
 

packages/db/src/index.ts

@@ -12,7 +12,7 @@ export function getDb() {
   if (_db) return _db;
   const url = process.env.DATABASE_URL;
   if (!url) throw new Error("DATABASE_URL is not set");
-  const client = postgres(url, { max: 10, connect_timeout: 5 });
+  const client = postgres(url, { max: 10 });
   _db = drizzle(client, { schema });
   return _db;
 }

pnpm-lock.yaml

@@ -970,66 +970,79 @@ packages:
     resolution: {integrity: sha512-DV6fJoxEYWJOvaZIsok7KrYl0tPvga5OZ2yvKHNNYyk/2roMLqQAbGhr78EQ5YhHpnhLKJD3S1WFusAkmUuV5g==}
     cpu: [arm]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm-musleabihf@4.60.3':
     resolution: {integrity: sha512-mQKoJAzvuOs6F+TZybQO4GOTSMUu7v0WdxEk24krQ/uUxXoPTtHjuaUuPmFhtBcM4K0ons8nrE3JyhTuCFtT/w==}
     cpu: [arm]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-arm64-gnu@4.60.3':
     resolution: {integrity: sha512-Whjj2qoiJ6+OOJMGptTYazaJvjOJm+iKHpXQM1P3LzGjt7Ff++Tp7nH4N8J/BUA7R9IHfDyx4DJIflifwnbmIA==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm64-musl@4.60.3':
     resolution: {integrity: sha512-4YTNHKqGng5+yiZt3mg77nmyuCfmNfX4fPmyUapBcIk+BdwSwmCWGXOUxhXbBEkFHtoN5boLj/5NON+u5QC9tg==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-loong64-gnu@4.60.3':
     resolution: {integrity: sha512-SU3kNlhkpI4UqlUc2VXPGK9o886ZsSeGfMAX2ba2b8DKmMXq4AL7KUrkSWVbb7koVqx41Yczx6dx5PNargIrEA==}
     cpu: [loong64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-loong64-musl@4.60.3':
     resolution: {integrity: sha512-6lDLl5h4TXpB1mTf2rQWnAk/LcXrx9vBfu/DT5TIPhvMhRWaZ5MxkIc8u4lJAmBo6klTe1ywXIUHFjylW505sg==}
     cpu: [loong64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-ppc64-gnu@4.60.3':
     resolution: {integrity: sha512-BMo8bOw8evlup/8G+cj5xWtPyp93xPdyoSN16Zy90Q2QZ0ZYRhCt6ZJSwbrRzG9HApFabjwj2p25TUPDWrhzqQ==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-ppc64-musl@4.60.3':
     resolution: {integrity: sha512-E0L8X1dZN1/Rph+5VPF6Xj2G7JJvMACVXtamTJIDrVI44Y3K+G8gQaMEAavbqCGTa16InptiVrX6eM6pmJ+7qA==}
     cpu: [ppc64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-riscv64-gnu@4.60.3':
     resolution: {integrity: sha512-oZJ/WHaVfHUiRAtmTAeo3DcevNsVvH8mbvodjZy7D5QKvCefO371SiKRpxoDcCxB3PTRTLayWBkvmDQKTcX/sw==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-riscv64-musl@4.60.3':
     resolution: {integrity: sha512-Dhbyh7j9FybM3YaTgaHmVALwA8AkUwTPccyCQ79TG9AJUsMQqgN1DDEZNr4+QUfwiWvLDumW5vdwzoeUF+TNxQ==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-s390x-gnu@4.60.3':
     resolution: {integrity: sha512-cJd1X5XhHHlltkaypz1UcWLA8AcoIi1aWhsvaWDskD1oz2eKCypnqvTQ8ykMNI0RSmm7NkTdSqSSD7zM0xa6Ig==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-gnu@4.60.3':
     resolution: {integrity: sha512-DAZDBHQfG2oQuhY7mc6I3/qB4LU2fQCjRvxbDwd/Jdvb9fypP4IJ4qmtu6lNjes6B531AI8cg1aKC2di97bUxA==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-musl@4.60.3':
     resolution: {integrity: sha512-cRxsE8c13mZOh3vP+wLDxpQBRrOHDIGOWyDL93Sy0Ga8y515fBcC2pjUfFwUe5T7tqvTvWbCpg1URM/AXdWIXA==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-openbsd-x64@4.60.3':
     resolution: {integrity: sha512-QaWcIgRxqEdQdhJqW4DJctsH6HCmo5vHxY0krHSX4jMtOqfzC+dqDGuHM87bu4H8JBeibWx7jFz+h6/4C8wA5Q==}

src/__tests__/portal.test.ts

@@ -4,7 +4,6 @@ import { Hono } from "hono";
 const CLIENT_ID = "550e8400-e29b-41d4-a716-446655440001";
 const APPOINTMENT_ID = "660e8400-e29b-41d4-a716-446655440002";
 const SESSION_ID = "770e8400-e29b-41d4-a716-446655440003";
-const PET_ID = "880e8400-e29b-41d4-a716-446655440004";
 
 const futureDate = () => new Date(Date.now() + 30 * 60 * 1000);
 const pastDate = () => new Date(Date.now() - 5 * 60 * 1000);
@@ -38,38 +37,13 @@ const APPOINTMENT = {
   cancelledAt: null,
 };
 
-const PET = {
-  id: PET_ID,
-  clientId: CLIENT_ID,
-  name: "Fido",
-  species: "dog",
-  breed: "Labrador",
-  weightKg: "30.00",
-  dateOfBirth: null,
-  healthAlerts: null,
-  groomingNotes: null,
-  cutStyle: null,
-  shampooPreference: null,
-  specialCareNotes: null,
-  coatType: null,
-  petSizeCategory: null,
-  customFields: {},
-  photoKey: null,
-  photoUploadedAt: null,
-  image: null,
-  createdAt: new Date(),
-  updatedAt: new Date(),
-};
-
 let selectSessionRow: Record<string, unknown> | null = null;
 let selectAppointmentRow: Record<string, unknown> | null = null;
-let selectPetRow: Record<string, unknown> | null = null;
 let updatedValues: Record<string, unknown>[] = [];
 
 function resetMock() {
   selectSessionRow = null;
   selectAppointmentRow = null;
-  selectPetRow = null;
   updatedValues = [];
 }
 
@@ -88,8 +62,6 @@ vi.mock("@groombook/db", () => {
     return chain;
   }
 
-  let activeUpdateTable: string | null = null;
-
   const impersonationSessions = new Proxy(
     { _name: "impersonationSessions" },
     { get: (t, p) => (p === "_name" ? "impersonationSessions" : { table: "impersonationSessions", column: p }) }
@@ -100,16 +72,6 @@ vi.mock("@groombook/db", () => {
     { get: (t, p) => (p === "_name" ? "appointments" : { table: "appointments", column: p }) }
   );
 
-  const pets = new Proxy(
-    { _name: "pets" },
-    { get: (t, p) => (p === "_name" ? "pets" : { table: "pets", column: p }) }
-  );
-
-  const impersonationAuditLogs = new Proxy(
-    { _name: "impersonationAuditLogs" },
-    { get: (t, p) => (p === "_name" ? "impersonationAuditLogs" : { table: "impersonationAuditLogs", column: p }) }
-  );
-
   return {
     getDb: () => ({
       select: () => ({
@@ -120,44 +82,26 @@ vi.mock("@groombook/db", () => {
           if (table._name === "appointments") {
             return makeChainable(selectAppointmentRow ? [selectAppointmentRow] : []);
           }
-          if (table._name === "pets") {
-            return makeChainable(selectPetRow ? [selectPetRow] : []);
-          }
           return makeChainable([]);
         },
       }),
-      insert: () => ({
+      update: () => ({
-        values: () => ({
+        set: (vals: Record<string, unknown>) => ({
-          returning: () => [{}],
+          where: () => ({
+            returning: () => {
+              if (selectAppointmentRow) {
+                const updated = { ...selectAppointmentRow, ...vals };
+                updatedValues.push(vals);
+                return [updated];
+              }
+              return [];
+            },
+          }),
         }),
       }),
-      update: (table: { _name: string }) => {
-        activeUpdateTable = table._name;
-        return {
-          set: (vals: Record<string, unknown>) => ({
-            where: () => ({
-              returning: () => {
-                if (activeUpdateTable === "appointments" && selectAppointmentRow) {
-                  const updated = { ...selectAppointmentRow, ...vals };
-                  updatedValues.push(vals);
-                  return [updated];
-                }
-                if (activeUpdateTable === "pets" && selectPetRow) {
-                  const updated = { ...selectPetRow, ...vals };
-                  updatedValues.push(vals);
-                  return [updated];
-                }
-                return [];
-              },
-            }),
-          }),
-        };
-      },
     }),
     impersonationSessions,
     appointments,
-    pets,
-    impersonationAuditLogs,
     eq: vi.fn(),
     and: vi.fn(),
   };
@@ -476,81 +420,4 @@ describe("POST /portal/appointments/:id/cancel", () => {
     );
     expect(res.status).toBe(404);
   });
-});
-
-// ─── PATCH /portal/pets/:id ───────────────────────────────────────────────────
-
-function jsonPetPatch(path: string, body: unknown, headers?: Record<string, string>) {
-  return app.request(path, {
-    method: "PATCH",
-    headers: {
-      "Content-Type": "application/json",
-      ...headers,
-    },
-    body: JSON.stringify(body),
-  });
-}
-
-describe("PATCH /portal/pets/:id", () => {
-  it("updates a pet and returns the updated pet in portal shape", async () => {
-    selectSessionRow = ACTIVE_SESSION;
-    selectPetRow = { ...PET, dateOfBirth: new Date("2020-01-15"), photoKey: "pets/test.jpg" };
-    const res = await jsonPetPatch(
-      `/portal/pets/${PET_ID}`,
-      { name: "Fido Jr.", groomingNotes: "Needs extra brushing" },
-      { "X-Impersonation-Session-Id": SESSION_ID }
-    );
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body).toHaveProperty("id");
-    expect(body).toHaveProperty("name", "Fido Jr.");
-    expect(body).toHaveProperty("notes", "Needs extra brushing");
-    expect(body).toHaveProperty("breed");
-    expect(body).toHaveProperty("photoUrl");
-    expect(body).not.toHaveProperty("clientId");
-    expect(body).not.toHaveProperty("customFields");
-  });
-
-  it("returns 401 without X-Impersonation-Session-Id header", async () => {
-    const res = await jsonPetPatch(`/portal/pets/${PET_ID}`, { name: "Test" });
-    expect(res.status).toBe(401);
-    const body = await res.json();
-    expect(body.error).toBe("Unauthorized");
-  });
-
-  it("returns 401 with expired session", async () => {
-    selectSessionRow = EXPIRED_SESSION;
-    const res = await jsonPetPatch(
-      `/portal/pets/${PET_ID}`,
-      { name: "Test" },
-      { "X-Impersonation-Session-Id": SESSION_ID }
-    );
-    expect(res.status).toBe(401);
-    const body = await res.json();
-    expect(body.error).toBe("Unauthorized");
-  });
-
-  it("returns 403 when pet belongs to a different client", async () => {
-    selectSessionRow = { ...ACTIVE_SESSION, clientId: "different-client-id" };
-    selectPetRow = { ...PET };
-    const res = await jsonPetPatch(
-      `/portal/pets/${PET_ID}`,
-      { name: "Hacked" },
-      { "X-Impersonation-Session-Id": SESSION_ID }
-    );
-    expect(res.status).toBe(403);
-    const body = await res.json();
-    expect(body.error).toBe("Forbidden");
-  });
-
-  it("returns 404 when pet not found", async () => {
-    selectSessionRow = ACTIVE_SESSION;
-    selectPetRow = null;
-    const res = await jsonPetPatch(
-      `/portal/pets/nonexistent-id`,
-      { name: "Ghost" },
-      { "X-Impersonation-Session-Id": SESSION_ID }
-    );
-    expect(res.status).toBe(404);
-  });
 });

src/index.ts

@@ -59,9 +59,6 @@ app.use(
 );
 
 // Health check — no auth required, registered on app at full path before auth middleware
-// /health: used by Dockerfile HEALTHCHECK and K8s readinessProbe/livenessProbe (port 3000 direct)
-app.get("/health", (c) => c.json({ status: "ok" }));
-// /api/health: used by Gateway HTTPRoute (/api/* → API pod)
 app.get("/api/health", (c) => c.json({ status: "ok" }));
 
 // Public booking routes — no auth required, must be registered before auth middleware
@@ -285,16 +282,14 @@ startReminderScheduler();
 
 function shutdown() {
   console.log("Shutting down gracefully...");
-  // SIGTERM/SIGINT → server.close() → callback → process.exit(0)
-  // If graceful close takes >8s, force-exit to avoid being killed undrained
-  setTimeout(() => {
-    console.error("Graceful close timeout — forcing exit");
-    process.exit(1);
-  }, 8_000);
   server.close(() => {
     console.log("HTTP server closed");
     process.exit(0);
   });
+  setTimeout(() => {
+    console.error("Forced shutdown after timeout");
+    process.exit(1);
+  }, 10_000);
 }
 
 process.on("SIGTERM", shutdown);

src/lib/auth.ts

@@ -186,9 +186,7 @@ export async function initAuth(): Promise<void> {
     const discoveryUrlStr = `${providerConfig.issuerUrl}/.well-known/openid-configuration`;
     let oidcConfig: Record<string, string> = {};
     try {
-      const discoveryRes = await fetch(discoveryUrlStr, {
+      const discoveryRes = await fetch(discoveryUrlStr);
-        signal: AbortSignal.timeout(5000),
-      });
       if (discoveryRes.ok) {
         const discovery = await discoveryRes.json() as {
           authorization_endpoint?: string;

src/middleware/auth.ts

@@ -23,7 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
+  if (c.req.path.startsWith("/api/auth/")) {
     await next();
     return;
   }

src/routes/portal.ts

@@ -152,67 +152,6 @@ portalRouter.get("/pets", async (c) => {
   return c.json(clientPets.map(p => ({ id: p.id, name: p.name, breed: p.breed, weight: p.weightKg, birthDate: p.dateOfBirth, photoUrl: p.photoKey, notes: p.groomingNotes })));
 });
 
-const portalUpdatePetSchema = z.object({
-  name: z.string().min(1).max(200).optional(),
-  species: z.string().min(1).max(100).optional(),
-  breed: z.string().max(200).optional(),
-  weightKg: z.number().positive().optional(),
-  dateOfBirth: z.string().datetime().optional(),
-  healthAlerts: z.string().max(2000).optional(),
-  groomingNotes: z.string().max(2000).optional(),
-  cutStyle: z.string().max(500).optional(),
-  shampooPreference: z.string().max(500).optional(),
-  specialCareNotes: z.string().max(2000).optional(),
-  customFields: z.record(z.string(), z.string()).optional(),
-  petSizeCategory: z.enum(["small", "medium", "large", "extra_large"]).optional(),
-  coatType: z.enum(["short", "medium", "long", "double", "wire", "silky", "curly", "hairless"]).optional(),
-});
-
-portalRouter.patch(
-  "/pets/:id",
-  zValidator("json", portalUpdatePetSchema),
-  async (c) => {
-    const db = getDb();
-    const petId = c.req.param("id");
-    const clientId = c.get("portalClientId");
-    const body = c.req.valid("json");
-
-    const [existing] = await db
-      .select()
-      .from(pets)
-      .where(eq(pets.id, petId))
-      .limit(1);
-
-    if (!existing) return c.json({ error: "Not found" }, 404);
-    if (existing.clientId !== clientId) return c.json({ error: "Forbidden" }, 403);
-
-    const { weightKg, dateOfBirth, customFields, ...rest } = body;
-    const [updated] = await db
-      .update(pets)
-      .set({
-        ...rest,
-        weightKg: weightKg?.toString(),
-        dateOfBirth: dateOfBirth ? new Date(dateOfBirth) : undefined,
-        ...(customFields !== undefined ? { customFields } : {}),
-        updatedAt: new Date(),
-      })
-      .where(eq(pets.id, petId))
-      .returning();
-
-    if (!updated) return c.json({ error: "Not found" }, 404);
-
-    return c.json({
-      id: updated.id,
-      name: updated.name,
-      breed: updated.breed,
-      weight: updated.weightKg,
-      birthDate: updated.dateOfBirth,
-      photoUrl: updated.photoKey,
-      notes: updated.groomingNotes,
-    });
-  }
-);
-
 portalRouter.get("/invoices", async (c) => {
   const db = getDb();
   const clientId = c.get("portalClientId");