fix(api): add timeouts for OIDC discovery fetch and DB connection

- OIDC discovery fetch in initAuth() now has a 5s AbortSignal.timeout to fail fast instead of hanging indefinitely when the auth server is unreachable. This was identified as a root cause of startup ECONNRESET crashes on UAT where ztunnel drops TCP connections before headers arrive. - DB postgres client now sets connect_timeout: 5 so failed connection attempts fail fast rather than hanging the startup sequence. - Graceful shutdown timeout tightened to 8s (from 10s) to avoid getting killed by Kubernetes liveness-probe deadline while draining. Fixes GRO-1678. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-24 19:46:23 +00:00
19 changed files with 11 additions and 1213 deletions
@@ -1 +0,0 @@
-GRO-1757 direct push CI trigger - 2026-05-26T00:15:41Z
@@ -78,8 +78,6 @@ jobs:

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
@@ -91,7 +89,6 @@ jobs:
      - name: Build and push API image
        uses: docker/build-push-action@v6
        with:
-          provenance: false
          context: .
          file: Dockerfile
          target: runner
@@ -105,7 +102,6 @@ jobs:
      - name: Build and push Migrate image
        uses: docker/build-push-action@v6
        with:
-          provenance: false
          context: .
          file: Dockerfile
          target: migrate
@@ -119,7 +115,6 @@ jobs:
      - name: Build and push Seed image
        uses: docker/build-push-action@v6
        with:
-          provenance: false
          context: .
          file: Dockerfile
          target: seed
@@ -133,7 +128,6 @@ jobs:
      - name: Build and push Reset image
        uses: docker/build-push-action@v6
        with:
-          provenance: false
          context: .
          file: Dockerfile
          target: reset
@@ -48,26 +48,6 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | TC-API-1.15 | Name fallback — no name, no email | Auto-provision where Better-Auth user has name = null, email = null | Staff name = "Unknown" |
 | TC-API-1.16 | OIDC login — Terraform-provisioned user | Initiate OIDC login as any UAT persona (uat-super, uat-groomer, uat-customer, uat-tester), complete authentik callback | 200 OK, session created — no account_not_linked error |

-#### SSO Login Journey (Authentik OIDC end-to-end)
-
-| # | Scenario | Steps | Pass Criteria | Fail Criteria |
-|---|----------|-------|---------------|---------------|
-| TC-API-1.17 | SSO redirect to Authentik | Navigate to app → sign-in page shown → click "Sign in with SSO" | Redirected to Authentik at auth.farh.net | 403 error, redirect loop, no SSO button |
-| TC-API-1.18 | Authenticate with valid OIDC credentials | At Authentik login page, enter valid credentials and authenticate | Redirected back to app with valid session | Redirect loop, 403, missing session cookie |
-| TC-API-1.19 | SSO user auto-provisioned as groomer | Complete SSO login as a user with no pre-existing staff record | 200 response; groomer staff record auto-created; session active | 403 Forbidden, staff record not created |
-| TC-API-1.20 | Existing staff record resolves correctly | Complete SSO login as uat-groomer (pre-existing staff) | 200 OK, correct staff identity resolved, no duplicate record created | 403, duplicate record, wrong staff data |
-| TC-API-1.21 | SSO session grants dashboard access | After TC-API-1.18 SSO login, GET /api/staff/me | 200 OK, valid staff record returned, correct role displayed | 401/403, missing session, wrong identity |
-
-#### OOBE Flow Post-Login
-
-| # | Scenario | Steps | Pass Criteria | Fail Criteria |
-|---|----------|-------|---------------|---------------|
-| TC-API-1.22 | Fresh DB reports needsSetup | On a fresh DB (no super user), GET /api/setup/status | needsSetup: true returned | needsSetup: false when it should be true |
-| TC-API-1.23 | Configure OIDC via auth-provider endpoint | POST /api/setup/auth-provider with valid OIDC config | 200 OK, auth provider configured, no 403 | 403, setup blocked, invalid config rejected |
-| TC-API-1.24 | Complete setup creates super user | POST /api/setup with business name (after TC-API-1.23) | First user becomes super user, setup completes | Setup errors, 403 on admin endpoints |
-| TC-API-1.25 | Super user accesses admin features | After TC-API-1.24, GET /api/staff/me and verify isSuperUser: true | isSuperUser: true, admin endpoints accessible | 403 on admin, isSuperUser: false |
-| TC-API-1.26 | Auto-provision skipped during OOBE | During fresh setup (needsSetup: true), complete OIDC login — verify no duplicate staff record created before setup completes | No duplicate staff, OOBE completes successfully | Duplicate staff record, 403 before setup, auto-provision interferes with OOBE |
-
 ### 4.2 Client Management

 | # | Scenario | Steps | Expected |
@@ -98,10 +78,6 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | TC-API-3.13 | Reject too many temperamentFlags | POST /api/pets with 21 temperamentFlags | 400 Bad Request, max 20 flags enforced |
 | TC-API-3.14 | Reject too many preferredCuts | POST /api/pets with 21 preferredCuts | 400 Bad Request, max 20 cuts enforced |
 | TC-API-3.15 | Reject too many medicalAlerts | POST /api/pets with 51 medicalAlerts | 400 Bad Request, max 50 alerts enforced |
-| TC-API-3.16 | Get pet profile summary | GET /api/pets/{id}/profile-summary | 200 OK, aggregated profile with grooming history, visit count, upcoming appointment |
-| TC-API-3.17 | Get pet profile summary — groomer restricted | GET /api/pets/{id}/profile-summary as groomer with no pet linkage | 403 Forbidden |
-| TC-API-3.18 | Get pet profile summary — visitCount returns full count | GET /api/pets/{id}/profile-summary with 2+ completed appointments | visitCount >= 2 (not capped at 1) |
-| TC-API-3.19 | Get pet profile summary — upcomingAppointment excludes past | GET /api/pets/{id}/profile-summary with a past confirmed/scheduled appointment | upcomingAppointment is null (past appointments filtered by startTime >= now) |

 ### 4.4 Appointment Scheduling

@@ -163,10 +139,6 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | TC-API-8.5 | Add waitlist entry | POST /api/portal/waitlist with pet and service | 201 Created, waitlist entry created |
 | TC-API-8.6 | View portal invoices | GET /api/portal/invoices | 200 OK, list of client's invoices returned |
 | TC-API-8.7 | Pay multiple invoices | POST /api/portal/invoices/pay-multiple with invoice IDs | 200 OK, payment intent created |
-| TC-API-8.8 | SSO bridge — valid Better Auth session | POST /api/portal/session-from-auth with valid Better Auth session cookie (authenticated SSO user with matching client email) | 201 Created, `{sessionId, clientId, clientName}` returned |
-| TC-API-8.9 | SSO bridge — no Better Auth session | POST /api/portal/session-from-auth without Better Auth session cookie | 401 Unauthorized |
-| TC-API-8.10 | SSO bridge — no matching client | POST /api/portal/session-from-auth with valid Better Auth session for a user with no client record | 404 Not Found, error "No client record found for this user" |
-| TC-API-8.11 | SSO bridge — returned session works on portal routes | After TC-API-8.8, use returned sessionId as `X-Impersonation-Session-Id` header on GET /api/portal/me | 200 OK, client profile returned |

 ### 4.9 Waitlist

@@ -1,357 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { Hono } from "hono";
-import type { AppEnv, StaffRow } from "../middleware/rbac.js";
-import { petsRouter } from "../routes/pets.js";
-
-// ─── Mock staff fixtures ──────────────────────────────────────────────────────
-
-const MANAGER: StaffRow = {
-  id: "staff-manager-id",
-  oidcSub: "oidc-manager-sub",
-  userId: null,
-  role: "manager",
-  isSuperUser: true,
-  name: "Manager McManager",
-  email: "manager@example.com",
-  active: true,
-  icalToken: null,
-  createdAt: new Date(),
-  updatedAt: new Date(),
-};
-
-const GROOMER: StaffRow = {
-  id: "staff-groomer-id",
-  oidcSub: "oidc-groomer-sub",
-  userId: null,
-  role: "groomer",
-  isSuperUser: false,
-  name: "Groomer McGroome",
-  email: "groomer@example.com",
-  active: true,
-  icalToken: null,
-  createdAt: new Date(),
-  updatedAt: new Date(),
-};
-
-// ─── Mutable mock state ───────────────────────────────────────────────────────
-
-const CLIENT_ID = "client-uuid-summary";
-const PET_ID = "pet-uuid-summary";
-
-interface MockState {
-  pets: Record<string, unknown>[];
-  appointments: Record<string, unknown>[];
-  groomingLogs: Record<string, unknown>[];
-  staffMembers: Record<string, unknown>[];
-  services: Record<string, unknown>[];
-}
-
-let mock: MockState;
-
-function resetMock() {
-  mock = {
-    pets: [{
-      id: PET_ID,
-      clientId: CLIENT_ID,
-      name: "Biscuit",
-      species: "dog",
-      breed: "Golden Retriever",
-      weightKg: "30.00",
-      dateOfBirth: null,
-      healthAlerts: null,
-      groomingNotes: null,
-      cutStyle: null,
-      shampooPreference: null,
-      specialCareNotes: null,
-      customFields: {},
-      photoKey: null,
-      photoUploadedAt: null,
-      image: null,
-      coatType: "double",
-      temperamentScore: 3,
-      temperamentFlags: ["gentle"],
-      medicalAlerts: [],
-      preferredCuts: ["puppy cut"],
-      createdAt: new Date("2024-01-01"),
-      updatedAt: new Date("2024-01-01"),
-    }],
-    appointments: [
-      {
-        id: "appt-completed-1",
-        clientId: CLIENT_ID,
-        petId: PET_ID,
-        serviceId: "service-1",
-        staffId: "staff-groomer-id",
-        batherStaffId: null,
-        status: "completed",
-        startTime: new Date("2024-06-01T09:00:00Z"),
-        endTime: new Date("2024-06-01T11:00:00Z"),
-        notes: null,
-        priceCents: 6000,
-        seriesId: null,
-        seriesIndex: null,
-        groupId: null,
-        confirmationStatus: "confirmed",
-        confirmedAt: null,
-        cancelledAt: null,
-        confirmationToken: null,
-        customerNotes: null,
-        createdAt: new Date("2024-05-15"),
-        updatedAt: new Date("2024-05-15"),
-      },
-      {
-        id: "appt-upcoming-1",
-        clientId: CLIENT_ID,
-        petId: PET_ID,
-        serviceId: "service-2",
-        staffId: "staff-groomer-id",
-        batherStaffId: null,
-        status: "confirmed",
-        startTime: new Date("2024-12-01T09:00:00Z"),
-        endTime: new Date("2024-12-01T11:00:00Z"),
-        notes: null,
-        priceCents: 6500,
-        seriesId: null,
-        seriesIndex: null,
-        groupId: null,
-        confirmationStatus: "confirmed",
-        confirmedAt: null,
-        cancelledAt: null,
-        confirmationToken: null,
-        customerNotes: null,
-        createdAt: new Date("2024-11-01"),
-        updatedAt: new Date("2024-11-01"),
-      },
-    ],
-    groomingLogs: [
-      {
-        id: "log-1",
-        petId: PET_ID,
-        appointmentId: "appt-completed-1",
-        staffId: "staff-groomer-id",
-        cutStyle: "puppy cut",
-        productsUsed: "oatmeal shampoo",
-        notes: "Trimmed nails",
-        groomedAt: new Date("2024-06-01T10:00:00Z"),
-        createdAt: new Date("2024-06-01T10:00:00Z"),
-      },
-    ],
-    staffMembers: [
-      {
-        id: "staff-groomer-id",
-        name: "Groomer McGroome",
-        email: "groomer@example.com",
-        role: "groomer",
-        isSuperUser: false,
-        active: true,
-        oidcSub: "oidc-groomer-sub",
-        userId: null,
-        icalToken: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-      {
-        id: "staff-manager-id",
-        name: "Manager McManager",
-        email: "manager@example.com",
-        role: "manager",
-        isSuperUser: true,
-        active: true,
-        oidcSub: "oidc-manager-sub",
-        userId: null,
-        icalToken: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-    ],
-    services: [
-      { id: "service-1", name: "Full Groom", description: null, basePriceCents: 6000, durationMinutes: 120, active: true, createdAt: new Date(), updatedAt: new Date() },
-      { id: "service-2", name: "Bath & Brush", description: null, basePriceCents: 4000, durationMinutes: 60, active: true, createdAt: new Date(), updatedAt: new Date() },
-    ],
-  };
-}
-
-vi.mock("../db/index.js", () => {
-  const pets = new Proxy({ _name: "pets" }, { get: (t, p) => p === "_name" ? "pets" : {} });
-  const appointments = new Proxy({ _name: "appointments" }, { get: (t, p) => p === "_name" ? "appointments" : {} });
-  const groomingVisitLogs = new Proxy({ _name: "groomingVisitLogs" }, { get: (t, p) => p === "_name" ? "groomingVisitLogs" : {} });
-  const staff = new Proxy({ _name: "staff" }, { get: (t, p) => p === "_name" ? "staff" : {} });
-  const services = new Proxy({ _name: "services" }, { get: (t, p) => p === "_name" ? "services" : {} });
-
-  function makeChainable(rows: unknown[]) {
-    const arr = rows as unknown[];
-    return new Proxy(arr, {
-      get(target, prop) {
-        if (prop === "where" || prop === "orderBy" || prop === "limit" || prop === "leftJoin" || prop === "from") {
-          return () => makeChainable(target);
-        }
-        if (prop === Symbol.iterator) {
-          return function* () { for (const v of target) yield v; };
-        }
-        // @ts-expect-error proxy
-        return target[prop];
-      },
-    });
-  }
-
-  return {
-    getDb: () => ({
-      select: () => ({
-        from: (table: unknown) => {
-          const name = (table as { _name?: string })._name;
-          if (name === "pets") return makeChainable(mock.pets);
-          if (name === "appointments") return makeChainable(mock.appointments);
-          if (name === "groomingVisitLogs") return makeChainable(mock.groomingLogs);
-          if (name === "staff") return makeChainable(mock.staffMembers);
-          if (name === "services") return makeChainable(mock.services);
-          return makeChainable([]);
-        },
-      }),
-      insert: () => ({ values: () => ({ returning: () => [{}] }) }),
-      update: () => ({ set: () => ({ where: () => ({ returning: () => [{}] }) }) }),
-      delete: () => ({ where: () => ({ returning: () => [{}] }) }),
-    }),
-    pets,
-    appointments,
-    groomingVisitLogs,
-    staff,
-    services,
-    and: vi.fn((a: unknown, b: unknown) => [a, b]),
-    desc: vi.fn((c: unknown) => c),
-    eq: vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val })),
-    exists: vi.fn(() => true),
-    gte: vi.fn((a: unknown, b: unknown) => ({ col: a, val: b })),
-    or: vi.fn((a: unknown, b: unknown) => [a, b]),
-    sql: vi.fn((str: string) => str),
-  };
-});
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-function makeApp(staff: StaffRow = MANAGER) {
-  const app = new Hono<AppEnv>();
-  app.use("*", async (c, next) => {
-    c.set("staff", staff);
-    await next();
-  });
-  return app.route("/pets", petsRouter);
-}
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-
-describe("GET /:id/profile-summary", () => {
-  beforeEach(resetMock);
-
-  it("returns 404 for non-existent pet", async () => {
-    const app = makeApp();
-    mock.pets = [];
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(404);
-  });
-
-  it("returns 403 for groomer with no pet linkage", async () => {
-    const app = makeApp(GROOMER);
-    // Groomer has no linkage to this pet's client — clear appointments
-    mock.appointments = [];
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(403);
-  });
-
-  it("returns complete aggregated profile for manager", async () => {
-    const app = makeApp(MANAGER);
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.id).toBe(PET_ID);
-    expect(body.name).toBe("Biscuit");
-    expect(body.species).toBe("dog");
-    expect(body.recentGroomingHistory).toBeInstanceOf(Array);
-    expect(body.lastVisitDate).toBeTruthy();
-    expect(body.visitCount).toBeGreaterThanOrEqual(0);
-  });
-
-  it("groomer with pet linkage returns 200", async () => {
-    const app = makeApp(GROOMER);
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-  });
-
-  it("recentGroomingHistory is limited to 10 entries", async () => {
-    const app = makeApp(MANAGER);
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.recentGroomingHistory.length).toBeLessThanOrEqual(10);
-  });
-
-  it("returns null upcomingAppointment when none scheduled", async () => {
-    const app = makeApp(MANAGER);
-    mock.appointments = [];
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.upcomingAppointment).toBeNull();
-  });
-});
-
-describe("GET /:id/profile-summary — visitCount", () => {
-  beforeEach(resetMock);
-
-  it("returns visitCount >= 2 when pet has 2+ completed appointments", async () => {
-    const app = makeApp(MANAGER);
-    // Add a second completed appointment
-    mock.appointments = [
-      ...mock.appointments,
-      {
-        id: "appt-completed-2",
-        clientId: CLIENT_ID,
-        petId: PET_ID,
-        serviceId: "service-1",
-        staffId: "staff-groomer-id",
-        batherStaffId: null,
-        status: "completed",
-        startTime: new Date("2024-07-01T09:00:00Z"),
-        endTime: new Date("2024-07-01T11:00:00Z"),
-        notes: null,
-        priceCents: 6000,
-        seriesId: null,
-        seriesIndex: null,
-        groupId: null,
-        confirmationStatus: "confirmed",
-        confirmedAt: null,
-        cancelledAt: null,
-        confirmationToken: null,
-        customerNotes: null,
-        createdAt: new Date("2024-06-15"),
-        updatedAt: new Date("2024-06-15"),
-      },
-    ];
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.visitCount).toBeGreaterThanOrEqual(2);
-  });
-
-  it("returns visitCount = 0 when no completed appointments", async () => {
-    const app = makeApp(MANAGER);
-    mock.appointments = mock.appointments.map((a) => ({ ...a, status: "cancelled" }));
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.visitCount).toBe(0);
-  });
-});
-
-describe("GET /:id/profile-summary — empty history", () => {
-  beforeEach(resetMock);
-
-  it("returns empty history array when no grooming logs", async () => {
-    const app = makeApp(MANAGER);
-    mock.groomingLogs = [];
-    const res = await app.request(`/pets/${PET_ID}/profile-summary`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.recentGroomingHistory).toEqual([]);
-    expect(body.lastVisitDate).toBeNull();
-  });
-});
@@ -36,19 +36,6 @@ const DEMO_PET = {
  weightKg: "30.00",
 };

-const UAT_CLIENT = {
-  name: "UAT Customer",
-  email: "uat-customer@groombook.dev",
-  phone: "555-0100",
-  address: "1 UAT Lane, Test City, CA 90210",
-  status: "active" as const,
-};
-
-const UAT_PETS = [
-  { name: "Bella", species: "Dog", breed: "Poodle", coatType: "curly" as const, weightKg: "20.00" },
-  { name: "Max", species: "Dog", breed: "Labrador Retriever", coatType: "smooth" as const, weightKg: "30.00" },
-];
-
 const DEMO_SERVICES = [
  { id: "b0000001-0000-0000-0000-000000000001", name: "Bath & Brush", description: "Full bath, blow-dry, brush out, and ear cleaning", basePriceCents: 4500, durationMinutes: 45 },
  { id: "b0000001-0000-0000-0000-000000000002", name: "Full Groom — Small", description: "Complete grooming for dogs under 25 lbs", basePriceCents: 6500, durationMinutes: 60 },
@@ -56,7 +43,7 @@ const DEMO_SERVICES = [
  { id: "b0000001-0000-0000-0000-000000000004", name: "Nail Trim", description: "Nail clipping and filing", basePriceCents: 1500, durationMinutes: 15 },
 ];

-adminSeedRouter.post("/", async (c) => {
+adminSeedRouter.post("/seed", async (c) => {
  // Refuse to run when AUTH_DISABLED — dev environments use direct-DB seeding
  if (process.env.AUTH_DISABLED === "true") {
    return c.json(
@@ -141,51 +128,6 @@ adminSeedRouter.post("/", async (c) => {
    results.push(`Created pet '${DEMO_PET.name}' for Demo Client (id: ${created!.id})`);
  }

-  // ── Client: UAT Customer ──────────────────────────────────────────────────
-  const [existingUatClient] = await db
-    .select()
-    .from(clients)
-    .where(eq(clients.email, UAT_CLIENT.email));
-
-  let uatClientId: string;
-  if (existingUatClient) {
-    uatClientId = existingUatClient.id;
-    results.push(`Client '${UAT_CLIENT.name}' already exists (id: ${uatClientId})`);
-  } else {
-    const [created] = await db.insert(clients).values(UAT_CLIENT).returning();
-    uatClientId = created!.id;
-    results.push(`Created client '${UAT_CLIENT.name}' (id: ${uatClientId})`);
-  }
-
-  // ── Pets: UAT Customer's Pets ─────────────────────────────────────────────
-  const existingUatPets = await db
-    .select()
-    .from(pets)
-    .where(eq(pets.clientId, uatClientId));
-
-  for (const uatPet of UAT_PETS) {
-    const existingPet = existingUatPets.find(
-      (p) => p.name === uatPet.name && p.species === uatPet.species
-    );
-    if (existingPet) {
-      results.push(`Pet '${uatPet.name}' already exists for UAT Customer (id: ${existingPet.id})`);
-    } else {
-      const [created] = await db
-        .insert(pets)
-        .values({
-          clientId: uatClientId,
-          name: uatPet.name,
-          species: uatPet.species,
-          breed: uatPet.breed,
-          coatType: uatPet.coatType,
-          weightKg: uatPet.weightKg,
-          dateOfBirth: new Date("2019-01-01T00:00:00Z"),
-        })
-        .returning();
-      results.push(`Created pet '${uatPet.name}' for UAT Customer (id: ${created!.id})`);
-    }
-  }
-
  return c.json({
    message: "Seed complete",
    details: results,
@@ -194,4 +136,4 @@ adminSeedRouter.post("/", async (c) => {
      staffOidcSub: KNOWN_STAFF.oidcSub,
    },
  });
-});
+});
@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { and, desc, eq, exists, getDb, gte, groomingVisitLogs, or, pets, appointments, staff, services, sql } from "../db/index.js";
+import { and, eq, exists, getDb, or, pets, appointments } from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";
 import {
  getPresignedUploadUrl,
@@ -283,133 +283,3 @@ petsRouter.get("/:petId/photo", async (c) => {
  const url = await getPresignedGetUrl(pet.photoKey);
  return c.json({ url, photoKey: pet.photoKey, photoUploadedAt: pet.photoUploadedAt });
 });
-
-// ─── Profile Summary ───────────────────────────────────────────────────────────
-
-async function groomerLinkageCheck(
-  db: ReturnType<typeof getDb>,
-  clientId: string,
-  staffRow: NonNullable<AppEnv["Variables"]["staff"]>
-): Promise<boolean> {
-  const [linkage] = await db
-    .select({ id: appointments.id })
-    .from(appointments)
-    .where(
-      and(
-        eq(appointments.clientId, clientId),
-        or(
-          eq(appointments.staffId, staffRow.id),
-          eq(appointments.batherStaffId, staffRow.id)
-        )
-      )
-    )
-    .limit(1);
-  return !!linkage;
-}
-
-/**
- * GET /:id/profile-summary
- * Returns aggregated profile: basic pet fields + grooming history + visit stats + upcoming appointment.
- * Groomer RBAC: same visibility rules as GET /:id.
- */
-petsRouter.get("/:id/profile-summary", async (c) => {
-  const db = getDb();
-  const petId = c.req.param("id");
-  const staffRow = c.get("staff");
-  const isGroomer = staffRow?.role === "groomer";
-
-  const [row] = await db.select().from(pets).where(eq(pets.id, petId));
-  if (!row) return c.json({ error: "Not found" }, 404);
-
-  if (isGroomer) {
-    const hasLinkage = await groomerLinkageCheck(db, row.clientId, staffRow);
-    if (!hasLinkage) return c.json({ error: "Forbidden" }, 403);
-  }
-
-  // Recent grooming history: last 10, with staff name join
-  const historyRows = await db
-    .select({
-      id: groomingVisitLogs.id,
-      petId: groomingVisitLogs.petId,
-      appointmentId: groomingVisitLogs.appointmentId,
-      staffId: groomingVisitLogs.staffId,
-      staffName: staff.name,
-      cutStyle: groomingVisitLogs.cutStyle,
-      productsUsed: groomingVisitLogs.productsUsed,
-      notes: groomingVisitLogs.notes,
-      groomedAt: groomingVisitLogs.groomedAt,
-      createdAt: groomingVisitLogs.createdAt,
-    })
-    .from(groomingVisitLogs)
-    .leftJoin(staff, eq(staff.id, groomingVisitLogs.staffId))
-    .where(eq(groomingVisitLogs.petId, petId))
-    .orderBy(desc(groomingVisitLogs.groomedAt))
-    .limit(10);
-
-  const recentGroomingHistory = historyRows.map((r) => ({
-    id: r.id,
-    petId: r.petId,
-    appointmentId: r.appointmentId,
-    staffId: r.staffId,
-    staffName: r.staffName,
-    cutStyle: r.cutStyle,
-    productsUsed: r.productsUsed,
-    notes: r.notes,
-    groomedAt: r.groomedAt?.toISOString() ?? null,
-    createdAt: r.createdAt?.toISOString() ?? null,
-  }));
-
-  const lastVisitDate = historyRows[0]?.groomedAt?.toISOString() ?? null;
-
-  // Completed appointment count for this pet
-  const [{ count: visitCount }] = await db
-    .select({ count: sql<number>`count(*)::int` })
-    .from(appointments)
-    .where(and(eq(appointments.petId, petId), eq(appointments.status, "completed")));
-
-  // Upcoming appointment: next scheduled or confirmed
-  const [nextAppt] = await db
-    .select({
-      id: appointments.id,
-      serviceId: appointments.serviceId,
-      staffId: appointments.staffId,
-      startTime: appointments.startTime,
-      endTime: appointments.endTime,
-      status: appointments.status,
-      serviceName: services.name,
-      staffName: staff.name,
-    })
-    .from(appointments)
-    .leftJoin(services, eq(services.id, appointments.serviceId))
-    .leftJoin(staff, eq(staff.id, appointments.staffId))
-    .where(
-      and(
-        eq(appointments.petId, petId),
-        or(eq(appointments.status, "scheduled"), eq(appointments.status, "confirmed")),
-        gte(appointments.startTime, new Date())
-      )
-    )
-    .orderBy(appointments.startTime)
-    .limit(1);
-
-  const upcomingAppointment = nextAppt
-    ? {
-        id: nextAppt.id,
-        serviceId: nextAppt.serviceId,
-        serviceName: nextAppt.serviceName,
-        staffId: nextAppt.staffId,
-        staffName: nextAppt.staffName,
-        startTime: nextAppt.startTime?.toISOString() ?? null,
-        endTime: nextAppt.endTime?.toISOString() ?? null,
-        status: nextAppt.status,
-      }
-    : null;
-
-  return c.json({
-    ...row,
-    recentGroomingHistory,
-    lastVisitDate,
-    visitCount,
-    upcomingAppointment,
-  });
-});
@@ -1,8 +0,0 @@
-- Migration: 0034_extend_pet_profile_columns.sql
-- GRO-1850: Adds temperament_score, temperament_flags, medical_alerts,
-- and preferred_cuts columns to the pets table.
-
-ALTER TABLE "pets" ADD COLUMN "temperament_score" integer;
-ALTER TABLE "pets" ADD COLUMN "temperament_flags" jsonb DEFAULT '[]';
-ALTER TABLE "pets" ADD COLUMN "medical_alerts" jsonb DEFAULT '[]';
-ALTER TABLE "pets" ADD COLUMN "preferred_cuts" jsonb DEFAULT '[]';
@@ -1,210 +0,0 @@
-{
-  "id": "0034_extend_pet_profile_columns",
-  "prevId": "b3a381ca-f7a4-450f-aa7e-fdc2d652dc97",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.pets": {
-      "name": "pets",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "uuid",
-          "primaryKey": true,
-          "notNull": true,
-          "default": "gen_random_uuid()"
-        },
-        "client_id": {
-          "name": "client_id",
-          "type": "uuid",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "name": {
-          "name": "name",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "species": {
-          "name": "species",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "breed": {
-          "name": "breed",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "weight_kg": {
-          "name": "weight_kg",
-          "type": "numeric(5, 2)",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "date_of_birth": {
-          "name": "date_of_birth",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "health_alerts": {
-          "name": "health_alerts",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "grooming_notes": {
-          "name": "grooming_notes",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "cut_style": {
-          "name": "cut_style",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "shampoo_preference": {
-          "name": "shampoo_preference",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "special_care_notes": {
-          "name": "special_care_notes",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "coat_type": {
-          "name": "coat_type",
-          "type": "coat_type",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "pet_size_category": {
-          "name": "pet_size_category",
-          "type": "pet_size_category",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "temperament_score": {
-          "name": "temperament_score",
-          "type": "integer",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "temperament_flags": {
-          "name": "temperament_flags",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": false,
-          "default": "'[]'::jsonb"
-        },
-        "medical_alerts": {
-          "name": "medical_alerts",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": false,
-          "default": "'[]'::jsonb"
-        },
-        "preferred_cuts": {
-          "name": "preferred_cuts",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": false,
-          "default": "'[]'::jsonb"
-        },
-        "custom_fields": {
-          "name": "custom_fields",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{}'::jsonb"
-        },
-        "photo_key": {
-          "name": "photo_key",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "photo_uploaded_at": {
-          "name": "photo_uploaded_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "image": {
-          "name": "image",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "updated_at": {
-          "name": "updated_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "pets_client_id_clients_id_fk": {
-          "name": "pets_client_id_clients_id_fk",
-          "tableFrom": "pets",
-          "tableTo": "clients",
-          "columnsFrom": [
-            "client_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    }
-  },
-  "enums": {
-    "coat_type": {
-      "name": "coat_type",
-      "values": [
-        "short",
-        "medium",
-        "long",
-        "wire",
-        "double",
-        "hairless",
-        "curly"
-      ]
-    },
-    "pet_size_category": {
-      "name": "pet_size_category",
-      "values": [
-        "small",
-        "medium",
-        "large",
-        "extra_large"
-      ]
-    }
-  },
-  "nativeEnums": {}
-}
@@ -239,13 +239,6 @@
      "when": 1779500000000,
      "tag": "0033_add_services_default_buffer_minutes",
      "breakpoints": true
-    },
-    {
-      "idx": 34,
-      "version": "7",
-      "when": 1751140800000,
-      "tag": "0034_extend_pet_profile_columns",
-      "breakpoints": true
    }
  ]
 }
@@ -105,10 +105,6 @@ export function buildPet(overrides: Partial<PetRow> & { clientId: string }): Pet
    photoKey: null,
    photoUploadedAt: null,
    image: null,
-    temperamentScore: null,
-    temperamentFlags: [],
-    medicalAlerts: [],
-    preferredCuts: [],
    createdAt: new Date("2025-01-01T00:00:00Z"),
    updatedAt: new Date("2025-01-01T00:00:00Z"),
  };
@@ -11,7 +11,6 @@ import {
  unique,
  uuid,
 } from "drizzle-orm/pg-core";
-import type { MedicalAlert } from "@groombook/types";

 // ─── Enums ────────────────────────────────────────────────────────────────────

@@ -165,10 +164,6 @@ export const pets = pgTable(
    specialCareNotes: text("special_care_notes"),
    coatType: coatTypeEnum("coat_type"),
    petSizeCategory: petSizeCategoryEnum("pet_size_category"),
-    temperamentScore: integer("temperament_score"),
-    temperamentFlags: jsonb("temperament_flags").$type<string[]>().default([]),
-    medicalAlerts: jsonb("medical_alerts").$type<MedicalAlert[]>().default([]),
-    preferredCuts: jsonb("preferred_cuts").$type<string[]>().default([]),
    customFields: jsonb("custom_fields").$type<Record<string, string>>().notNull().default({}),
    photoKey: text("photo_key"),
    photoUploadedAt: timestamp("photo_uploaded_at"),
@@ -225,34 +225,3 @@ export interface MedicalAlert {
 }

 export type CoatType = "smooth" | "double" | "curly" | "wire" | "long" | "hairless";
-
-export interface GroomingHistoryEntry {
-  id: string;
-  petId: string;
-  appointmentId: string | null;
-  staffId: string | null;
-  staffName: string | null;
-  cutStyle: string | null;
-  productsUsed: string | null;
-  notes: string | null;
-  groomedAt: string;
-  createdAt: string;
-}
-
-export interface UpcomingAppointment {
-  id: string;
-  serviceId: string;
-  serviceName: string;
-  staffId: string | null;
-  staffName: string | null;
-  startTime: string;
-  endTime: string;
-  status: AppointmentStatus;
-}
-
-export interface PetProfileSummary extends Pet {
-  recentGroomingHistory: GroomingHistoryEntry[];
-  lastVisitDate: string | null;
-  visitCount: number;
-  upcomingAppointment: UpcomingAppointment | null;
-}
@@ -1,175 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { Hono } from "hono";
-import { getAuth } from "../lib/auth.js";
-
-const CLIENT_ID = "550e8400-e29b-41d4-a716-446655440001";
-const CLIENT_EMAIL = "alice@example.com";
-const CLIENT_NAME = "Alice Smith";
-
-const BETTER_AUTH_SESSION = {
-  user: {
-    id: "auth-user-001",
-    email: CLIENT_EMAIL,
-    name: CLIENT_NAME,
-  },
-  session: {
-    id: "ba-session-001",
-    expiresAt: new Date(Date.now() + 60 * 60 * 1000),
-  },
-};
-
-const MOCK_CLIENT = {
-  id: CLIENT_ID,
-  email: CLIENT_EMAIL,
-  name: CLIENT_NAME,
-};
-
-let mockGetAuth: ReturnType<typeof vi.fn>;
-let mockGetSession: ReturnType<typeof vi.fn>;
-let insertedSession: Record<string, unknown> | null = null;
-let mockClientRow: Record<string, unknown> | null = null;
-let mockStaffRow: Record<string, unknown> | null = null;
-
-function makeChainable(data: unknown[]): unknown {
-  const arr = [...data];
-  return new Proxy(arr, {
-    get(target, prop) {
-      if (prop === "where" || prop === "orderBy" || prop === "limit") {
-        return () => makeChainable(target);
-      }
-      // @ts-expect-error proxy
-      return target[prop];
-    },
-  });
-}
-
-vi.mock("@groombook/db", () => {
-  const impersonationSessions = new Proxy(
-    { _name: "impersonationSessions" },
-    { get: (t, p) => (p === "_name" ? "impersonationSessions" : { table: "impersonationSessions", column: p }) }
-  );
-
-  const clients = new Proxy(
-    { _name: "clients" },
-    { get: (t, p) => (p === "_name" ? "clients" : { table: "clients", column: p }) }
-  );
-
-  const staff = new Proxy(
-    { _name: "staff" },
-    { get: (t, p) => (p === "_name" ? "staff" : { table: "staff", column: p }) }
-  );
-
-  return {
-    getDb: () => ({
-      select: () => ({
-        from: (table: { _name: string }) => {
-          if (table._name === "clients") {
-            return makeChainable(mockClientRow ? [mockClientRow] : []);
-          }
-          if (table._name === "staff") {
-            return makeChainable(mockStaffRow ? [mockStaffRow] : []);
-          }
-          return makeChainable([]);
-        },
-      }),
-      insert: (table: { _name: string }) => ({
-        values: (vals: Record<string, unknown>) => ({
-          returning: () => {
-            if (table._name === "impersonationSessions") {
-              insertedSession = { id: "new-session-001", ...vals };
-              return [insertedSession];
-            }
-            return [];
-          },
-        }),
-      }),
-    }),
-    impersonationSessions,
-    clients,
-    staff,
-    eq: vi.fn(),
-    and: vi.fn(),
-    inArray: vi.fn(),
-  };
-});
-
-vi.mock("../lib/auth.js", () => ({
-  getAuth: vi.fn(),
-}));
-
-const { portalRouter } = await import("../routes/portal.js");
-
-const app = new Hono();
-app.route("/portal", portalRouter);
-
-describe("POST /portal/session-from-auth", () => {
-  beforeEach(() => {
-    insertedSession = null;
-    mockClientRow = null;
-    mockStaffRow = null;
-    mockGetSession = vi.fn();
-    mockGetAuth = vi.fn(() => ({
-      api: {
-        getSession: mockGetSession,
-      },
-    }));
-    vi.mocked(getAuth).mockImplementation(mockGetAuth);
-  });
-
-  it("returns 401 when no Better Auth session", async () => {
-    mockGetSession.mockResolvedValue(null);
-    const res = await app.request("/portal/session-from-auth", {
-      method: "POST",
-    });
-    expect(res.status).toBe(401);
-    const body = await res.json();
-    expect(body.error).toBe("Unauthorized");
-  });
-
-  it("returns 404 when authenticated user has no client record", async () => {
-    mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION);
-    mockClientRow = null;
-    const res = await app.request("/portal/session-from-auth", {
-      method: "POST",
-    });
-    expect(res.status).toBe(404);
-    const body = await res.json();
-    expect(body.error).toBe("No client record found for this user");
-  });
-
-  it("returns a portal session with sessionId, clientId, clientName when client is found", async () => {
-    mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION);
-    mockClientRow = MOCK_CLIENT;
-    mockStaffRow = { id: "00000000-0000-0000-0000-000000000001" };
-    const res = await app.request("/portal/session-from-auth", {
-      method: "POST",
-    });
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    expect(body).toHaveProperty("sessionId");
-    expect(body).toHaveProperty("clientId", CLIENT_ID);
-    expect(body).toHaveProperty("clientName", CLIENT_NAME);
-  });
-
-  it("creates a portal session with reason sso-bridge", async () => {
-    mockGetSession.mockResolvedValue(BETTER_AUTH_SESSION);
-    mockClientRow = MOCK_CLIENT;
-    mockStaffRow = { id: "00000000-0000-0000-0000-000000000001" };
-    const res = await app.request("/portal/session-from-auth", {
-      method: "POST",
-    });
-    expect(res.status).toBe(201);
-    expect(insertedSession).not.toBeNull();
-    expect((insertedSession as Record<string, unknown>).reason).toBe("sso-bridge");
-  });
-
-  it("returns 503 when auth is not configured", async () => {
-    mockGetAuth.mockImplementation(() => {
-      throw new Error("Auth not initialized");
-    });
-    const res = await app.request("/portal/session-from-auth", {
-      method: "POST",
-    });
-    expect(res.status).toBe(503);
-  });
-});
@@ -59,9 +59,6 @@ app.use(
 );

 // Health check — no auth required, registered on app at full path before auth middleware
-// /health: used by Dockerfile HEALTHCHECK and K8s readinessProbe/livenessProbe (port 3000 direct)
-app.get("/health", (c) => c.json({ status: "ok" }));
-// /api/health: used by Gateway HTTPRoute (/api/* → API pod)
 app.get("/api/health", (c) => c.json({ status: "ok" }));

 // Public booking routes — no auth required, must be registered before auth middleware
@@ -172,7 +172,7 @@ export async function initAuth(): Promise<void> {
        clientSecret: oidcClientSecret,
        issuerUrl: oidcIssuer,
        internalBaseUrl: process.env.OIDC_INTERNAL_BASE,
-        scopes: "openid profile email role",
+        scopes: "openid profile email",
      };
      console.log("[auth] Using env var config (no DB config found)");
    }
@@ -23,7 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }

 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
+  if (c.req.path.startsWith("/api/auth/")) {
    await next();
    return;
  }
@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff, account } from "@groombook/db";
+import { and, eq, getDb, sql, staff } from "@groombook/db";

 export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
@@ -22,7 +22,7 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
  c,
  next
 ) => {
-  // Better-Auth\'s own routes handle their own auth — skip staff resolution
+  // Better-Auth's own routes handle their own auth — skip staff resolution
  // OOBE setup routes also handle their own auth — staff record is created during setup
  if (c.req.path.startsWith("/api/auth/") || c.req.path.startsWith("/api/setup")) {
    await next();
@@ -110,51 +110,6 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
      return;
    }
  }
-
-  // Auto-provision for OIDC users: check if jwt.sub has an OAuth/OIDC account
-  // (e.g. authentik). If so, create a groomer staff record on the fly.
-  if (jwt.email) {
-    const [oidcAccount] = await db
-      .select({ id: account.id })
-      .from(account)
-      .where(
-        and(
-          eq(account.userId, jwt.sub),
-          sql`${account.providerId} IN (\'authentik\', \'google\', \'github\')`
-        )
-      )
-      .limit(1);
-
-    if (oidcAccount) {
-      // Derive name: prefer jwt.name, fall back to email prefix, then "Unknown"
-      const emailPrefix = jwt.email ? jwt.email.split("@")[0] : "Unknown";
-      const name = jwt.name?.trim() || emailPrefix;
-
-      const [newStaff] = await db
-        .insert(staff)
-        .values({
-          userId: jwt.sub,
-          email: (jwt.email ?? "") as string,
-          name,
-          role: "groomer",
-          isSuperUser: false,
-          active: true,
-        } as Parameters<typeof db.insert>[0] extends { values: infer V } ? V : never)
-        .returning()!;
-
-      if (!newStaff) {
-        return c.json({ error: "Forbidden: auto-provision failed" }, 500);
-      }
-
-      console.log(
-        `[rbac] auto-provisioned staff record for OIDC user: ${jwt.sub} -> staff:${newStaff.id} (${name})`
-      );
-      c.set("staff", newStaff);
-      await next();
-      return;
-    }
-  }
-
  return c.json(
    { error: "Forbidden: no staff record found for authenticated user" },
    403
@@ -180,7 +135,7 @@ export function requireRole(
    if (!(allowedRoles as string[]).includes(staffRow.role)) {
      return c.json(
        {
-          error: `Forbidden: role \'${staffRow.role}\' is not permitted to access this resource`,
+          error: `Forbidden: role '${staffRow.role}' is not permitted to access this resource`,
        },
        403
      );
@@ -213,7 +168,7 @@ export function requireRoleOrSuperUser(
      {
        error: hasAllowedRole
          ? "Forbidden: super user privileges required"
-          : `Forbidden: role \'${staffRow.role}\' is not permitted`,
+          : `Forbidden: role '${staffRow.role}' is not permitted`,
      },
      403
    );
@@ -36,19 +36,6 @@ const DEMO_PET = {
  weightKg: "30.00",
 };

-const UAT_CLIENT = {
-  name: "UAT Customer",
-  email: "uat-customer@groombook.dev",
-  phone: "555-0100",
-  address: "1 UAT Lane, Test City, CA 90210",
-  status: "active" as const,
-};
-
-const UAT_PETS = [
-  { name: "Bella", species: "Dog", breed: "Poodle", coatType: "curly", weightKg: "20.00" },
-  { name: "Max", species: "Dog", breed: "Labrador Retriever", coatType: "smooth", weightKg: "30.00" },
-];
-
 const DEMO_SERVICES = [
  { id: "b0000001-0000-0000-0000-000000000001", name: "Bath & Brush", description: "Full bath, blow-dry, brush out, and ear cleaning", basePriceCents: 4500, durationMinutes: 45 },
  { id: "b0000001-0000-0000-0000-000000000002", name: "Full Groom — Small", description: "Complete grooming for dogs under 25 lbs", basePriceCents: 6500, durationMinutes: 60 },
@@ -56,7 +43,7 @@ const DEMO_SERVICES = [
  { id: "b0000001-0000-0000-0000-000000000004", name: "Nail Trim", description: "Nail clipping and filing", basePriceCents: 1500, durationMinutes: 15 },
 ];

-adminSeedRouter.post("/", async (c) => {
+adminSeedRouter.post("/seed", async (c) => {
  // Refuse to run when AUTH_DISABLED — dev environments use direct-DB seeding
  if (process.env.AUTH_DISABLED === "true") {
    return c.json(
@@ -141,51 +128,6 @@ adminSeedRouter.post("/", async (c) => {
    results.push(`Created pet '${DEMO_PET.name}' for Demo Client (id: ${created!.id})`);
  }

-  // ── Client: UAT Customer ──────────────────────────────────────────────────
-  const [existingUatClient] = await db
-    .select()
-    .from(clients)
-    .where(eq(clients.email, UAT_CLIENT.email));
-
-  let uatClientId: string;
-  if (existingUatClient) {
-    uatClientId = existingUatClient.id;
-    results.push(`Client '${UAT_CLIENT.name}' already exists (id: ${uatClientId})`);
-  } else {
-    const [created] = await db.insert(clients).values(UAT_CLIENT).returning();
-    uatClientId = created!.id;
-    results.push(`Created client '${UAT_CLIENT.name}' (id: ${uatClientId})`);
-  }
-
-  // ── Pets: UAT Customer's Pets ─────────────────────────────────────────────
-  const existingUatPets = await db
-    .select()
-    .from(pets)
-    .where(eq(pets.clientId, uatClientId));
-
-  for (const uatPet of UAT_PETS) {
-    const existing = existingUatPets.find(
-      (p) => p.name === uatPet.name && p.species === uatPet.species
-    );
-    if (existing) {
-      results.push(`Pet '${uatPet.name}' already exists for UAT Customer (id: ${existing.id})`);
-    } else {
-      const [created] = await db
-        .insert(pets)
-        .values({
-          clientId: uatClientId,
-          name: uatPet.name,
-          species: uatPet.species,
-          breed: uatPet.breed,
-          coatType: uatPet.coatType as any,
-          weightKg: uatPet.weightKg,
-          dateOfBirth: new Date("2019-01-01T00:00:00Z"),
-        })
-        .returning();
-      results.push(`Created pet '${uatPet.name}' for UAT Customer (id: ${created!.id})`);
-    }
-  }
-
  return c.json({
    message: "Seed complete",
    details: results,
@@ -36,7 +36,7 @@ portalRouter.post(
      return c.json({ error: "Client not found" }, 404);
    }

-    const DEMO_STAFF_ID = process.env.DEMO_STAFF_ID ?? "00000000-0000-0000-0000-000000000001";
+    const DEMO_STAFF_ID = "00000000-0000-0000-0000-000000000001";

    let staffId = DEMO_STAFF_ID;
    const [demoStaff] = await db
@@ -71,82 +71,6 @@ portalRouter.post(
  }
 );

-// Bridge Better Auth session → portal session for real SSO customers (GRO-1866).
-// Registered BEFORE the /* middleware so it is NOT subject to validatePortalSession.
-import { getAuth } from "../lib/auth.js";
-
-portalRouter.post("/session-from-auth", async (c) => {
-  let auth;
-  try {
-    auth = getAuth();
-  } catch {
-    return c.json({ error: "Authentication not configured" }, 503);
-  }
-
-  const session = await auth.api.getSession({
-    headers: c.req.raw.headers,
-  });
-
-  if (!session) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  const db = getDb();
-  const [client] = await db
-    .select()
-    .from(clients)
-    .where(eq(clients.email, session.user.email))
-    .limit(1);
-
-  if (!client) {
-    return c.json({ error: "No client record found for this user" }, 404);
-  }
-
-  const DEMO_STAFF_ID = process.env.DEMO_STAFF_ID ?? "00000000-0000-0000-0000-000000000001";
-
-  let staffId = DEMO_STAFF_ID;
-  const [demoStaff] = await db
-    .select({ id: staff.id })
-    .from(staff)
-    .where(eq(staff.id, DEMO_STAFF_ID))
-    .limit(1);
-
-  if (!demoStaff) {
-    const [firstStaff] = await db
-      .select({ id: staff.id })
-      .from(staff)
-      .where(eq(staff.active, true))
-      .limit(1);
-    if (!firstStaff) {
-      return c.json({ error: "No staff records found" }, 500);
-    }
-    staffId = firstStaff.id;
-  }
-
-  const [portalSession] = await db
-    .insert(impersonationSessions)
-    .values({
-      staffId,
-      clientId: client.id,
-      reason: "sso-bridge",
-      expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
-    })
-    .returning();
-
-  if (!portalSession) {
-    return c.json({ error: "Failed to create session" }, 500);
-  }
-
-  return c.json(
-    {
-      sessionId: portalSession.id,
-      clientId: client.id,
-      clientName: client.name,
-    },
-    201
-  );
-});
-
 // Apply middleware to all portal routes
 portalRouter.use("/*", validatePortalSession, portalAudit);
				`@@ -1 +0,0 @@`
				`GRO-1757 direct push CI trigger - 2026-05-26T00:15:41Z`