fix(ci): use REGISTRY_TOKEN for Docker push auth

Use the org-level REGISTRY_TOKEN secret instead of gitea.token for
authenticating to the Gitea Container Registry. The gitea.token
does not have packages:write scope.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -62,10 +62,6 @@ jobs:
     name: Build & Push Docker Image
     runs-on: ubuntu-latest
     needs: [lint-typecheck, test]
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -83,12 +79,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GitHub Container Registry
+      - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
+          registry: git.farh.net
-          username: ${{ github.actor }}
+          username: ${{ gitea.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push API image
         uses: docker/build-push-action@v6
@@ -97,7 +93,7 @@ jobs:
           file: Dockerfile
           push: true
           tags: |
-            ghcr.io/groombook/api:${{ steps.version.outputs.tag }}
+            git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/api:latest' || '' }}
+            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
-          cache-from: type=gha
+          cache-from: type=registry,ref=git.farh.net/groombook/cache:api
-          cache-to: type=gha,mode=max
+          cache-to: type=registry,ref=git.farh.net/groombook/cache:api,mode=max

src/middleware/rbac.ts

@@ -1,7 +1,7 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff, staffRoleEnum } from "@groombook/db";
+import { and, eq, getDb, sql, staff } from "@groombook/db";
 
-type StaffRole = typeof staffRoleEnum.enumValues[number];
+export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
 
 export interface AppEnv {
@@ -110,27 +110,6 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
       return;
     }
   }
-
-  // Auto-create staff record for authenticated OAuth users with no existing staff record
-  // This allows new OAuth users to access the app (defaults to receptionist role)
-  if (jwt.email && jwt.name) {
-    const [newStaff] = await db
-      .insert(staff)
-      .values({
-        email: jwt.email,
-        name: jwt.name,
-        userId: jwt.sub,
-        role: "receptionist",
-        active: true,
-      })
-      .returning();
-    if (newStaff) {
-      c.set("staff", newStaff);
-      await next();
-      return;
-    }
-  }
-
   return c.json(
     { error: "Forbidden: no staff record found for authenticated user" },
     403