Auto-create staff records for OAuth users with no existing staff record

Fixes GRO-1118 - uat-tester receives HTTP 403 post-login

When a user authenticates via OAuth but has no corresponding staff record,
the RBAC middleware now auto-creates a staff record with a default
"receptionist" role instead of returning 403. This allows new OAuth
users to access the app immediately.

The middleware now checks for staff records in this order:
1. By userId (Better-Auth user ID)
2. By oidcSub (legacy OIDC subject)
3. By email (auto-link existing staff)
4. Create new staff record if authenticated user has email and name

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.dockerignore

@@ -1,11 +0,0 @@
-node_modules
-.git
-*.md
-.github
-apps/e2e
-apps/web/dist
-apps/api/dist
-packages/db/dist
-packages/types/dist
-.turbo
-screenshots/

.editorconfig

@@ -1,12 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[*.md]
-trim_trailing_whitespace = false

.env.example

@@ -1,36 +0,0 @@
-# Groom Book — Environment Variables
-# Copy this file to .env and adjust values for your deployment.
-
-# ── Database ──────────────────────────────────────────────────────────────────
-DATABASE_URL=postgres://groombook:groombook@postgres:5432/groombook
-
-# ── Authentication ────────────────────────────────────────────────────────────
-# Set AUTH_DISABLED=true to skip OIDC validation (useful for local dev/Docker).
-# In production, configure an Authentik instance and set these values.
-AUTH_DISABLED=false
-OIDC_ISSUER=https://authentik.example.com
-OIDC_AUDIENCE=groombook
-
-# ── Setup Wizard ─────────────────────────────────────────────────────────────
-# When SKIP_OOBE=true, the setup wizard is bypassed regardless of whether a
-# super user exists in the database. Useful in dev/test environments where the
-# database has data but the setup wizard would otherwise block access.
-SKIP_OOBE=false
-
-# ── API ───────────────────────────────────────────────────────────────────────
-PORT=3000
-CORS_ORIGIN=http://localhost:8080
-
-# ── Email Reminders (optional) ────────────────────────────────────────────────
-# Leave SMTP_HOST unset to disable email notifications entirely.
-# When configured, appointment confirmation and reminder emails are sent via SMTP.
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=user@example.com
-SMTP_PASS=password
-SMTP_FROM="Groom Book <noreply@example.com>"
-
-# Hours before appointment to send reminder emails (defaults: 24 and 2)
-REMINDER_HOURS_EARLY=24
-REMINDER_HOURS_LATE=2

.github/workflows/ci.yml

@@ -32,10 +32,10 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Typecheck
-        run: pnpm --filter @groombook/api typecheck
+        run: pnpm typecheck
 
       - name: Lint
-        run: pnpm --filter @groombook/api lint
+        run: pnpm lint
 
   test:
     name: Test
@@ -56,39 +56,16 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Run tests
-        run: pnpm --filter @groombook/api test
-
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    needs: [lint-typecheck, test]
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build
-        run: pnpm --filter @groombook/api build
+        run: pnpm test
 
   docker:
-    name: Build & Push Docker Images
+    name: Build & Push Docker Image
     runs-on: ubuntu-latest
-    needs: [build]
-    outputs:
-      tag: ${{ steps.version.outputs.tag }}
+    needs: [lint-typecheck, test]
     permissions:
       contents: read
       packages: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -118,140 +95,9 @@ jobs:
         with:
           context: .
           file: Dockerfile
-          target: runner
           push: true
           tags: |
             ghcr.io/groombook/api:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/api:latest' || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-      - name: Build and push Migrate image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          target: migrate
-          push: true
-          tags: |
-            ghcr.io/groombook/migrate:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/migrate:latest' || '' }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Build and push Seed image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          target: seed
-          push: true
-          tags: |
-            ghcr.io/groombook/seed:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/seed:latest' || '' }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Build and push Reset image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          target: reset
-          push: true
-          tags: |
-            ghcr.io/groombook/reset:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/reset:latest' || '' }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  cd:
-    name: Update Infra Image Tags
-    runs-on: ubuntu-latest
-    needs: [docker]
-    if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') && github.event_name == 'push'
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Generate infra repo token
-        id: infra-token
-        uses: tibdex/github-app-token@v2
-        with:
-          app_id: ${{ vars.GH_APP_ID }}
-          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Clone groombook/infra
-        run: |
-          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra
-
-      - name: Install yq
-        run: |
-          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
-          sudo chmod +x /usr/local/bin/yq
-
-      - name: Update dev overlay image tags
-        env:
-          TAG: ${{ needs.docker.outputs.tag }}
-          SHA: ${{ github.sha }}
-        run: |
-          if [ -z "$TAG" ]; then
-            TAG="$(date -u +%Y.%m.%d)-${SHA::7}"
-          fi
-          export SHORT_SHA="${SHA::7}"
-          echo "Updating dev overlay image tags to: $TAG"
-          echo "Updating migration/seed Job names with SHA: $SHORT_SHA"
-          cd /tmp/infra
-          DEV_KUST="apps/overlays/dev/kustomization.yaml"
-          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "ghcr.io/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"
-
-          MIGRATE_JOB="apps/base/migrate-job.yaml"
-          if [ -f "$MIGRATE_JOB" ]; then
-            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
-            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
-            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$MIGRATE_JOB"
-          fi
-
-          SEED_JOB="apps/base/seed-job.yaml"
-          if [ -f "$SEED_JOB" ]; then
-            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
-            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
-            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$SEED_JOB"
-          fi
-
-          git -C /tmp/infra diff --stat
-
-      - name: Create PR on groombook/infra
-        env:
-          TAG: ${{ needs.docker.outputs.tag }}
-          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
-        run: |
-          if [ -z "$TAG" ]; then
-            TAG="$(date -u +%Y.%m.%d)-${GITHUB_SHA::7}"
-          fi
-
-          cd /tmp/infra
-          git config user.name "groombook-engineer[bot]"
-          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
-          git checkout -b "chore/update-image-tags-${TAG}"
-          git add apps/overlays/dev/ apps/base/migrate-job.yaml apps/base/seed-job.yaml
-          git commit -m "chore: update image tags and migration/seed Job names to ${TAG}"
-
-          git push -u origin "chore/update-image-tags-${TAG}"
-
-          EXISTING_PR=$(gh pr list --repo groombook/infra --head "chore/update-image-tags-${TAG}" --state open --json number -q '.[0].number' || true)
-          if [ -n "$EXISTING_PR" ]; then
-            echo "PR #$EXISTING_PR already exists for this tag, merging existing PR"
-            gh pr merge "$EXISTING_PR" --repo groombook/infra --merge
-          else
-            PR_URL=$(gh pr create \
-              --repo groombook/infra \
-              --base main \
-              --head "chore/update-image-tags-${TAG}" \
-              --title "chore: deploy ${TAG} to dev" \
-              --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
-            gh pr merge "$PR_URL" --merge
-          fi

.gitignore

@@ -1,23 +1,6 @@
 node_modules/
 dist/
-.env
-.env.local
-*.local
 .DS_Store
 *.log
-.turbo/
-coverage/
-minimax-output/
-
-# Agent runtime artifacts — never commit
-.gh-token
-*.gh-token
-.config/gh/
-**/.config/gh/
-infra-repo
-infra-repo/
-**/instructions/.gh-token
-**/AGENT_HOME/**
-$AGENT_HOME/**
-.claude/
-.codex/
+.env
+.env.local

Dockerfile

@@ -2,37 +2,51 @@ FROM node:20-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 WORKDIR /app
 
+# Install deps
 FROM base AS deps
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-COPY apps/api/package.json apps/api/
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY packages/db/package.json packages/db/
+COPY packages/types/package.json packages/types/
 RUN pnpm install --frozen-lockfile
 
+# Build
 FROM deps AS builder
 RUN mkdir -p /home/node/.cache/node/corepack
-COPY apps/api/ apps/api/
-RUN pnpm --filter @groombook/api build
+COPY packages/ packages/
+COPY src/ src/
+RUN pnpm --filter @groombook/types build && \
+    pnpm --filter @groombook/db build && \
+    pnpm build
 
+# Runtime
 FROM node:20-alpine AS runner
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 WORKDIR /app
 ENV NODE_ENV=production
 
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-COPY --from=builder /app/apps/api/package.json apps/api/
-COPY --from=builder /app/apps/api/dist apps/api/dist
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY --from=builder /app/package.json ./
+COPY --from=builder /app/dist dist/
+COPY --from=builder /app/packages/db/package.json packages/db/
+COPY --from=builder /app/packages/db/dist packages/db/dist
+COPY --from=builder /app/packages/types/package.json packages/types/
+COPY --from=builder /app/packages/types/dist packages/types/dist
 RUN pnpm install --frozen-lockfile --prod
 
 EXPOSE 3000
 RUN apk add --no-cache curl
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD curl -f http://localhost:3000/health || exit 1
-CMD ["node", "apps/api/dist/index.js"]
+CMD ["node", "dist/index.js"]
 
+# Migrate stage — runs drizzle-kit migrate against the database
 FROM builder AS migrate
-CMD ["pnpm", "--filter", "@groombook/api", "db:migrate"]
+CMD ["pnpm", "db:migrate"]
 
+# Seed stage — populates the database with test data
 FROM builder AS seed
-CMD ["pnpm", "--filter", "@groombook/api", "db:seed"]
+CMD ["pnpm", "db:seed"]
 
+# Reset stage — drops all tables, re-runs migrations, and re-seeds
 FROM builder AS reset
-CMD ["pnpm", "--filter", "@groombook/api", "db:reset"]
+CMD ["pnpm", "db:reset"]

README.md

@@ -1,38 +1,2 @@
-# GroomBook API
-
-GroomBook API service — extracted from the [groombook/app](https://github.com/groombook/app) monorepo.
-
-## Overview
-
-This repository contains the GroomBook API service, including:
-- REST API endpoints
-- Database schema and migrations (via Drizzle ORM)
-- Authentication (via Better Auth)
-- Background job handlers
-
-## Structure
-
-```
-apps/api/        # API service source
-packages/db/     # Database schema, migrations, and utilities
-packages/types/  # Shared TypeScript types
-```
-
-## Setup
-
-```bash
-pnpm install
-cp .env.example .env  # Fill in required environment variables
-pnpm --filter @groombook/api dev
-```
-
-## Docker
-
-```bash
-docker build -t ghcr.io/groombook/api:latest .
-docker run -p 3000:3000 ghcr.io/groombook/api:latest
-```
-
-## License
-
-AGPL-3.0-only
+# api
+GroomBook API service (extracted from groombook/app monorepo)

UAT_PLAYBOOK.md

@@ -1,223 +0,0 @@
-# UAT Playbook — GroomBook API
-
-## Overview
-
-GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet grooming management platform. Handles authentication, client/pet management, appointment scheduling, invoicing, payments, staff management, and the customer portal.
-
-## Environments
-
-| Environment | URL |
-|------------|-----|
-| Dev        | `dev.groombook.dev` |
-| UAT        | `uat.groombook.dev` |
-| Prod       | `demo.groombook.app` |
-
-## Pre-conditions
-
-- UAT environment accessible and healthy
-- Test accounts seeded (manager, staff, client personas)
-- OIDC authentication provider configured
-- Seed data present (clients, pets, services, staff)
-
-## Test Cases
-
-### 4.1 Authentication
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-1.1 | Login via OIDC | POST to OIDC provider callback, verify JWT token issued | 200 OK, JWT returned with valid claims |
-| TC-API-1.2 | Session persistence | Make authenticated request, verify session token valid | 200 OK, request succeeds |
-| TC-API-1.3 | Logout | Call logout endpoint, verify token invalidated | 200 OK, subsequent requests return 401 |
-| TC-API-1.4 | Email+password login (UAT) | POST /api/auth/sign-in/email with uat-super@groombook.dev + SEED_UAT_SUPER_PASSWORD | 200 OK, session cookie returned |
-| TC-API-1.5 | Email+password login — groomer | POST /api/auth/sign-in/email with uat-groomer@groombook.dev + SEED_UAT_GROOMER_PASSWORD | 200 OK, session cookie returned |
-| TC-API-1.6 | Email+password login — customer | POST /api/auth/sign-in/email with uat-customer@groombook.dev + SEED_UAT_CUSTOMER_PASSWORD | 200 OK, session cookie returned |
-| TC-API-1.7 | Email+password login — tester | POST /api/auth/sign-in/email with uat-tester@groombook.dev + SEED_UAT_TESTER_PASSWORD | 200 OK, session cookie returned |
-| TC-API-1.8 | Email+password — invalid password | POST /api/auth/sign-in/email with wrong password | 400 Bad Request, error returned |
-| TC-API-1.9 | Email+password — unknown user | POST /api/auth/sign-in/email with non-existent email | 400 Bad Request, error returned |
-
-### 4.2 Client Management
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-2.1 | List clients | GET /api/clients | 200 OK, list of active clients returned |
-| TC-API-2.2 | Get client details | GET /api/clients/{id} | 200 OK, client details returned |
-| TC-API-2.3 | Create client | POST /api/clients with valid data | 201 Created, client record created |
-| TC-API-2.4 | Update client | PATCH /api/clients/{id} with updated fields | 200 OK, client updated |
-| TC-API-2.5 | Disable client | PATCH /api/clients/{id} with status: "disabled" | 200 OK, client marked as disabled |
-| TC-API-2.6 | Delete client | DELETE /api/clients/{id}?confirm=true | 200 OK, client deleted (if no appointments) |
-
-### 4.3 Pet Management
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-3.1 | List pets | GET /api/pets | 200 OK, list of pets returned |
-| TC-API-3.2 | Get pet details | GET /api/pets/{id} | 200 OK, pet details including history returned |
-| TC-API-3.3 | Add pet | POST /api/pets with valid pet data | 201 Created, pet record created |
-| TC-API-3.4 | Update pet | PATCH /api/pets/{id} with updated fields | 200 OK, pet updated |
-| TC-API-3.5 | Delete pet | DELETE /api/pets/{id} | 200 OK, pet deleted |
-| TC-API-3.6 | Upload pet photo | POST /api/pets/{id}/photo/upload-url, then confirm | 200 OK, photo uploaded and key stored |
-| TC-API-3.7 | View pet photo | GET /api/pets/{id}/photo | 200 OK, presigned URL returned |
-
-### 4.4 Appointment Scheduling
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-4.1 | List appointments | GET /api/appointments | 200 OK, list of appointments returned |
-| TC-API-4.2 | Get appointment details | GET /api/appointments/{id} | 200 OK, appointment details returned |
-| TC-API-4.3 | Create single appointment | POST /api/appointments with valid data | 201 Created, appointment created |
-| TC-API-4.4 | Create recurring appointment | POST /api/appointments with recurrence object | 201 Created, series of appointments created |
-| TC-API-4.5 | Update appointment | PATCH /api/appointments/{id} with updated fields | 200 OK, appointment updated |
-| TC-API-4.6 | Reschedule with cascade | PATCH /api/appointments/{id} with cascadeMode: "this_and_future" | 200 OK, future appointments updated |
-| TC-API-4.7 | Cancel appointment | DELETE /api/appointments/{id} | 200 OK, appointment marked as cancelled |
-| TC-API-4.8 | Confirm appointment | POST /api/appointments/{id}/confirm | 200 OK, confirmation status set to confirmed |
-| TC-API-4.9 | Cancel confirmation | POST /api/appointments/{id}/cancel | 200 OK, confirmation cancelled |
-| TC-API-4.10 | Conflict detection | POST /api/appointments with conflicting time | 409 Conflict, error message returned |
-
-### 4.5 Services
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-5.1 | List services | GET /api/services | 200 OK, list of active services returned |
-| TC-API-5.2 | Get service details | GET /api/services/{id} | 200 OK, service details returned |
-| TC-API-5.3 | Create service | POST /api/services with valid data | 201 Created, service created |
-| TC-API-5.4 | Update service | PATCH /api/services/{id} with updated fields | 200 OK, service updated |
-| TC-API-5.5 | Delete service | DELETE /api/services/{id} | 200 OK, service deleted |
-
-### 4.6 Staff Management
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-6.1 | List staff | GET /api/staff | 200 OK, list of active staff returned |
-| TC-API-6.2 | Get staff details | GET /api/staff/{id} | 200 OK, staff details returned |
-| TC-API-6.3 | Create staff | POST /api/staff with valid data | 201 Created, staff created |
-| TC-API-6.4 | Update staff | PATCH /api/staff/{id} with updated fields | 200 OK, staff updated |
-| TC-API-6.5 | Delete staff | DELETE /api/staff/{id} | 200 OK, staff deleted (if no appointments) |
-| TC-API-6.6 | RBAC check | Access manager-only endpoint as groomer | 403 Forbidden, error message returned |
-
-### 4.7 Invoicing & Payments
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-7.1 | List invoices | GET /api/invoices | 200 OK, list of invoices returned |
-| TC-API-7.2 | Get invoice details | GET /api/invoices/{id} | 200 OK, invoice with line items returned |
-| TC-API-7.3 | Create invoice | POST /api/invoices with line items | 201 Created, invoice created |
-| TC-API-7.4 | Create from appointment | POST /api/invoices/from-appointment/{appointmentId} | 201 Created, invoice created from appointment |
-| TC-API-7.5 | Update invoice | PATCH /api/invoices/{id} with status and payment method | 200 OK, invoice updated |
-| TC-API-7.6 | Process payment via Stripe | POST /api/invoices/{id}/pay with Stripe data | 200 OK, payment intent created |
-| TC-API-7.7 | Save tip splits | POST /api/invoices/{id}/tip-splits with splits array | 201 Created, tip splits saved |
-| TC-API-7.8 | Process refund | POST /api/invoices/{id}/refund with amount | 200 OK, refund processed |
-
-### 4.8 Customer Portal
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-8.1 | Access portal | GET /api/portal/me with valid session token | 200 OK, client profile returned |
-| TC-API-8.2 | View portal appointments | GET /api/portal/appointments | 200 OK, list of client's appointments returned |
-| TC-API-8.3 | Confirm appointment via portal | POST /api/portal/appointments/{id}/confirm | 200 OK, appointment confirmed |
-| TC-API-8.4 | Cancel appointment via portal | POST /api/portal/appointments/{id}/cancel | 200 OK, appointment cancelled |
-| TC-API-8.5 | Add waitlist entry | POST /api/portal/waitlist with pet and service | 201 Created, waitlist entry created |
-| TC-API-8.6 | View portal invoices | GET /api/portal/invoices | 200 OK, list of client's invoices returned |
-| TC-API-8.7 | Pay multiple invoices | POST /api/portal/invoices/pay-multiple with invoice IDs | 200 OK, payment intent created |
-
-### 4.9 Waitlist
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-9.1 | List waitlist | GET /api/waitlist | 200 OK, list of waitlist entries returned |
-| TC-API-9.2 | Add to waitlist | POST /api/waitlist with client, pet, service | 201 Created, entry added |
-| TC-API-9.3 | Promote from waitlist | Create appointment from waitlist entry | 201 Created, appointment created, waitlist updated |
-
-### 4.10 Search
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-10.1 | Global search clients | GET /api/search?q={client_name} | 200 OK, matching clients returned |
-| TC-API-10.2 | Global search pets | GET /api/search?q={pet_name} | 200 OK, matching pets with owners returned |
-| TC-API-10.3 | Search by email | GET /api/search?q={email} | 200 OK, matching client returned |
-| TC-API-10.4 | Search by phone | GET /api/search?q={phone} | 200 OK, matching client returned |
-
-### 4.11 Reports
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-11.1 | Revenue summary | GET /api/reports/summary?from={date}&to={date} | 200 OK, revenue KPIs returned |
-| TC-API-11.2 | Revenue by period | GET /api/reports/revenue?groupBy=day | 200 OK, daily revenue breakdown returned |
-| TC-API-11.3 | Appointment analytics | GET /api/reports/appointments | 200 OK, appointment stats returned |
-| TC-API-11.4 | Service popularity | GET /api/reports/services | 200 OK, service usage stats returned |
-| TC-API-11.5 | Client retention | GET /api/reports/clients | 200 OK, new/returning/churn client data returned |
-| TC-API-11.6 | Tip splits report | GET /api/reports/tip-splits | 200 OK, tip earnings per staff returned |
-| TC-API-11.7 | Export revenue CSV | GET /api/reports/export.csv?type=revenue | 200 OK, CSV file downloaded |
-
-### 4.12 Impersonation
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-12.1 | Start impersonation session | POST /api/impersonation/sessions with clientId | 201 Created, session token returned |
-| TC-API-12.2 | Get session details | GET /api/impersonation/sessions/{id} | 200 OK, session details returned |
-| TC-API-12.3 | Extend session | POST /api/impersonation/sessions/{id}/extend | 200 OK, session expiry extended |
-| TC-API-12.4 | End session | POST /api/impersonation/sessions/{id}/end | 200 OK, session marked as ended |
-| TC-API-12.5 | Log audit entry | POST /api/impersonation/sessions/{id}/log | 201 Created, audit log entry created |
-| TC-API-12.6 | View audit log | GET /api/impersonation/sessions/{id}/audit-log | 200 OK, audit trail returned |
-
-### 4.13 Settings & Setup
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-13.1 | Get business settings | GET /api/admin/settings | 200 OK, business settings returned |
-| TC-API-13.2 | Update business settings | PATCH /api/admin/settings with updated values | 200 OK, settings updated |
-| TC-API-13.3 | Upload logo | POST /api/admin/settings/logo/upload with file | 200 OK, logo uploaded and stored |
-| TC-API-13.4 | View logo | GET /api/admin/settings/logo | 200 OK, logo image returned |
-| TC-API-13.5 | Delete logo | DELETE /api/admin/settings/logo | 200 OK, logo removed |
-| TC-API-13.6 | Check setup status | GET /api/setup/status | 200 OK, setup needs returned |
-| TC-API-13.7 | Complete setup | POST /api/setup with business name | 201 Created, super user created |
-| TC-API-13.8 | Configure auth provider | POST /api/setup/auth-provider with OIDC config | 201 Created, auth provider configured |
-| TC-API-13.9 | Test auth provider | POST /api/setup/auth-provider/test with issuer URL | 200 OK, OIDC discovery successful |
-
-### 4.14 Appointment Groups
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-14.1 | List appointment groups | GET /api/appointment-groups | 200 OK, list of groups returned |
-| TC-API-14.2 | Get group details | GET /api/appointment-groups/{id} | 200 OK, group with appointments returned |
-| TC-API-14.3 | Create group booking | POST /api/appointment-groups with client and pets | 201 Created, group and appointments created |
-| TC-API-14.4 | Update group notes | PATCH /api/appointment-groups/{id} with notes | 200 OK, notes updated |
-| TC-API-14.5 | Cancel group | DELETE /api/appointment-groups/{id} | 200 OK, all appointments cancelled |
-
-### 4.15 Public Booking Flow (Scheduling Engine Buffer Integration)
-
-| # | Scenario | Steps | Expected |
-|---|----------|-------|----------|
-| TC-API-15.1 | List active services | GET /api/book/services | 200 OK, list of active services with name, price, duration |
-| TC-API-15.2 | Get availability — missing params | GET /api/book/availability | 400 Bad Request, error indicating required params |
-| TC-API-15.3 | Get availability — invalid date | GET /api/book/availability?serviceId=uuid&date=invalid | 400 Bad Request, date must be YYYY-MM-DD |
-| TC-API-15.4 | Get availability — service not found | GET /api/book/availability?serviceId=nonexistent&date=2026-06-01 | 404 Not Found |
-| TC-API-15.5 | Get availability — valid date/service | GET /api/book/availability?serviceId={serviceId}&date=2026-06-01 | 200 OK, array of ISO startTime strings for available slots |
-| TC-API-15.6 | Availability excludes booked slots | GET /api/book/availability for date with existing appointments | 200 OK, only slots not overlapping booked appointments |
-| TC-API-15.7 | Availability respects groomer availability | GET /api/book/availability for date with no groomers | 200 OK, empty array |
-| TC-API-15.8 | Create booking — missing required fields | POST /api/book/appointments with partial data | 400 Bad Request, validation errors |
-| TC-API-15.9 | Create booking — invalid pet/client/service | POST /api/book/appointments with nonexistent IDs | 400/404 Bad Request |
-| TC-API-15.10 | Create booking — valid | POST /api/book/appointments with all required fields | 201 Created, appointment object returned |
-| TC-API-15.11 | Create booking — saves petSizeCategory | POST /api/book/appointments with petSizeCategory | 201 Created, pet's petSizeCategory updated |
-| TC-API-15.12 | Create booking — saves petCoatType | POST /api/book/appointments with petCoatType | 201 Created, pet's coatType updated |
-
-## Pass/Fail Criteria
-
-**Pass:**
-- All test cases execute without errors
-- Expected results match actual results
-- No regressions in previously working features
-- API responses have correct status codes and data structures
-- Authentication and authorization enforced correctly
-- Business rules (conflicts, validations) work as expected
-
-**Fail:**
-- Any unexpected result or error
-- API returns incorrect status codes
-- Data integrity issues
-- Authentication/authorization bypass
-- Business rules not enforced
-- Severity documented with steps to reproduce and screenshot
-
-## Update Policy
-
-Any PR that changes user-facing behaviour MUST update this file. Test cases must be added, modified, or removed to reflect the new behaviour. The PR description must reference which playbook section was updated (e.g., "Updated UAT_PLAYBOOK.md §4.4 — new appointment rescheduling flow").

apps/api/migrations/0030_extended_pet_profile.sql

@@ -1,12 +0,0 @@
--- Migration: 0030_extended_pet_profile
--- Adds extended profile fields to the pets table
-
-BEGIN;
-
-ALTER TABLE pets ADD COLUMN coat_type text;
-ALTER TABLE pets ADD COLUMN temperament_score integer;
-ALTER TABLE pets ADD COLUMN temperament_flags jsonb DEFAULT '[]'::jsonb;
-ALTER TABLE pets ADD COLUMN medical_alerts jsonb DEFAULT '[]'::jsonb;
-ALTER TABLE pets ADD COLUMN preferred_cuts jsonb DEFAULT '[]'::jsonb;
-
-COMMIT;

apps/api/migrations/meta/0030_snapshot.json

@@ -1,48 +0,0 @@
-{
-  "id": "0030_extended_pet_profile",
-  "prevId": "0028_sms_reminders",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.pets": {
-      "name": "pets",
-      "schema": "",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "client_id": { "name": "client_id", "type": "uuid", "isNullable": false },
-        "name": { "name": "name", "type": "text", "isNullable": false },
-        "species": { "name": "species", "type": "text", "isNullable": false },
-        "breed": { "name": "breed", "type": "text", "isNullable": true },
-        "weight_kg": { "name": "weight_kg", "type": "numeric(5, 2)", "isNullable": true },
-        "date_of_birth": { "name": "date_of_birth", "type": "timestamp", "isNullable": true },
-        "health_alerts": { "name": "health_alerts", "type": "text", "isNullable": true },
-        "grooming_notes": { "name": "grooming_notes", "type": "text", "isNullable": true },
-        "cut_style": { "name": "cut_style", "type": "text", "isNullable": true },
-        "shampoo_preference": { "name": "shampoo_preference", "type": "text", "isNullable": true },
-        "special_care_notes": { "name": "special_care_notes", "type": "text", "isNullable": true },
-        "custom_fields": { "name": "custom_fields", "type": "jsonb", "isNullable": false, "default": "'{}'::jsonb" },
-        "photo_key": { "name": "photo_key", "type": "text", "isNullable": true },
-        "photo_uploaded_at": { "name": "photo_uploaded_at", "type": "timestamp", "isNullable": true },
-        "image": { "name": "image", "type": "text", "isNullable": true },
-        "coat_type": { "name": "coat_type", "type": "text", "isNullable": true },
-        "temperament_score": { "name": "temperament_score", "type": "integer", "isNullable": true },
-        "temperament_flags": { "name": "temperament_flags", "type": "jsonb", "isNullable": true, "default": "'[]'::jsonb" },
-        "medical_alerts": { "name": "medical_alerts", "type": "jsonb", "isNullable": true, "default": "'[]'::jsonb" },
-        "preferred_cuts": { "name": "preferred_cuts", "type": "jsonb", "isNullable": true, "default": "'[]'::jsonb" },
-        "created_at": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updated_at": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": { "idx_pets_client_id": { "name": "idx_pets_client_id", "columns": [{ "expression": "client_id", "isExpression": false, "asc": true, "nulls": "last" }], "isUnique": false } },
-      "foreignKeys": { "pets_client_id_clients_id_fk": { "name": "pets_client_id_clients_id_fk", "tableFrom": "pets", "tableTo": "clients", "columnsFrom": ["client_id"], "columnsTo": ["id"], "onDelete": "cascade" } },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {}
-    }
-  },
-  "enums": {},
-  "schemas": {},
-  "sequences": {},
-  "roles": {},
-  "policies": {},
-  "views": {},
-  "_meta": { "columns": {}, "schemas": {}, "tables": {} }
-}

apps/api/package.json

@@ -1,47 +0,0 @@
-{
-  "name": "@groombook/api",
-  "version": "0.0.1",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "dev": "tsx watch src/index.ts",
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "lint": "eslint src --ext .ts",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "db:generate": "drizzle-kit generate",
-    "db:migrate": "drizzle-kit migrate",
-    "db:seed": "tsx src/db/seed.ts",
-    "db:reset": "tsx src/db/reset.ts && drizzle-kit migrate && tsx src/db/seed.ts",
-    "db:studio": "drizzle-kit studio"
-  },
-  "dependencies": {
-    "@aws-sdk/client-s3": "^3.800.0",
-    "@aws-sdk/s3-request-presigner": "^3.800.0",
-    "@hono/node-server": "^1.13.7",
-    "@hono/zod-validator": "^0.7.6",
-    "better-auth": "^1.5.6",
-    "drizzle-orm": "^0.38.4",
-    "hono": "^4.6.17",
-    "node-cron": "^3.0.3",
-    "nodemailer": "^6.9.16",
-    "postgres": "^3.4.5",
-    "stripe": "^22.0.0",
-    "telnyx": "^1.23.0",
-    "zod": "^4.3.6"
-  },
-  "devDependencies": {
-    "@types/node": "^22.10.7",
-    "@types/node-cron": "^3.0.11",
-    "@types/nodemailer": "^6.4.17",
-    "@vitest/coverage-v8": "^3.2.4",
-    "drizzle-kit": "^0.30.4",
-    "eslint": "^9.18.0",
-    "tsx": "^4.19.2",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.20.0",
-    "vitest": "^3.2.4"
-  },
-  "license": "AGPL-3.0-only"
-}

apps/api/src/__tests__/petsExtendedFields.test.ts

@@ -1,416 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { Hono } from "hono";
-import type { AppEnv, StaffRow } from "../middleware/rbac.js";
-import { petsRouter } from "../routes/pets.js";
-import { and, eq, exists, or } from "../db/index.js";
-
-// ─── Mock staff fixtures ──────────────────────────────────────────────────────
-
-const MANAGER: StaffRow = {
-  id: "staff-manager-id",
-  oidcSub: "oidc-manager-sub",
-  userId: null,
-  role: "manager",
-  isSuperUser: true,
-  name: "Manager McManager",
-  email: "manager@example.com",
-  active: true,
-  icalToken: null,
-  createdAt: new Date(),
-  updatedAt: new Date(),
-};
-
-// ─── Mutable mock state ───────────────────────────────────────────────────────
-
-const CLIENT_ID = "11111111-1111-1111-1111-111111111111";
-const PET_ID = "22222222-2222-2222-2222-222222222222";
-
-let petRows: Record<string, unknown>[] = [];
-let appointmentRows: Record<string, unknown>[] = [];
-let insertedValues: Record<string, unknown>[] = [];
-let updatedValues: Record<string, unknown>[] = [];
-let deletedId: string | null = null;
-
-function resetMock() {
-  petRows = [{
-    id: PET_ID,
-    clientId: CLIENT_ID,
-    name: "Biscuit",
-    species: "dog",
-    breed: "Golden Retriever",
-    weightKg: "30.00",
-    dateOfBirth: null,
-    healthAlerts: null,
-    groomingNotes: null,
-    cutStyle: null,
-    shampooPreference: null,
-    specialCareNotes: null,
-    customFields: {},
-    photoKey: null,
-    photoUploadedAt: null,
-    image: null,
-    coatType: null,
-    temperamentScore: null,
-    temperamentFlags: [],
-    medicalAlerts: [],
-    preferredCuts: [],
-    createdAt: new Date(),
-    updatedAt: new Date(),
-  }];
-  appointmentRows = [];
-  insertedValues = [];
-  updatedValues = [];
-  deletedId = null;
-}
-
-function makeSelectChainable(rows: unknown[]): unknown {
-  const chain = new Proxy([...rows], {
-    get(target, prop) {
-      if (prop === "where" || prop === "orderBy" || prop === "limit") {
-        return () => chain;
-      }
-      // @ts-expect-error proxy
-      return target[prop];
-    },
-  });
-  return chain;
-}
-
-function makeInsertChainable(): unknown {
-  let vals: Record<string, unknown> = {};
-  const chain = new Proxy({}, {
-    get(target, prop) {
-      if (prop === "values") {
-        return (v: Record<string, unknown>) => { vals = v; return chain; };
-      }
-      if (prop === "returning") {
-        return () => {
-          insertedValues.push(vals);
-          return [vals.id ? { ...vals, id: vals.id ?? PET_ID } : { ...vals, id: PET_ID }];
-        };
-      }
-      return chain;
-    },
-  });
-  return chain;
-}
-
-function makeUpdateChainable(): unknown {
-  let vals: Record<string, unknown> = {};
-  let whereId: string | null = null;
-  const chain = new Proxy({}, {
-    get(target, prop) {
-      if (prop === "set") {
-        return (v: Record<string, unknown>) => { vals = v; return chain; };
-      }
-      if (prop === "where") {
-        return (cond: unknown) => {
-          // Extract id from condition if it's an eq call
-          if (whereId) vals = { ...vals };
-          return chain;
-        };
-      }
-      if (prop === "returning") {
-        return () => {
-          const merged = { ...petRows[0], ...vals };
-          updatedValues.push(vals);
-          return [merged];
-        };
-      }
-      return chain;
-    },
-  });
-  return chain;
-}
-
-function makeDeleteChainable(): unknown {
-  let whereId: string | null = null;
-  const chain = new Proxy({}, {
-    get(target, prop) {
-      if (prop === "where") {
-        return (cond: unknown) => {
-          whereId = PET_ID;
-          return chain;
-        };
-      }
-      if (prop === "returning") {
-        return () => {
-          const row = petRows[0]!;
-          deletedId = row.id as string;
-          return [row];
-        };
-      }
-      return chain;
-    },
-  });
-  return chain;
-}
-
-vi.mock("../db", async (importOriginal) => {
-  const db = await importOriginal<typeof import("../db/index.js")>();
-  const pets = new Proxy({ _name: "pets" }, { get: (t, p) => p === "_name" ? "pets" : {} });
-  const appointments = new Proxy({ _name: "appointments" }, { get: (t, p) => p === "_name" ? "appointments" : {} });
-  return {
-    getDb: () => ({
-      select: () => ({
-        from: (table: unknown) => {
-          const name = (table as { _name?: string })._name;
-          if (name === "appointments") return makeSelectChainable(appointmentRows);
-          return makeSelectChainable(petRows);
-        },
-      }),
-      insert: () => makeInsertChainable(),
-      update: () => makeUpdateChainable(),
-      delete: () => makeDeleteChainable(),
-    }),
-    pets,
-    appointments,
-    and: db.and,
-    eq: db.eq,
-    exists: db.exists,
-    or: db.or,
-  };
-});
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-function makeApp(staff: StaffRow = MANAGER) {
-  const app = new Hono<AppEnv>();
-  app.use("*", async (c, next) => {
-    c.set("staff", staff);
-    await next();
-  });
-  return app.route("/pets", petsRouter);
-}
-
-function createApp() {
-  const app = makeApp(MANAGER);
-  return app;
-}
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-
-describe("Extended pet profile fields — validation", () => {
-  beforeEach(resetMock);
-
-  it("rejects temperamentScore of 0 (below min)", async () => {
-    const app = createApp();
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 0 }),
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.success).toBe(false);
-  });
-
-  it("rejects temperamentScore of 6 (above max)", async () => {
-    const app = createApp();
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 6 }),
-    });
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.success).toBe(false);
-  });
-
-  it("rejects non-integer temperamentScore", async () => {
-    const app = createApp();
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 3.5 }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("rejects invalid medicalAlert severity", async () => {
-    const app = createApp();
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        clientId: CLIENT_ID,
-        name: "Test",
-        species: "dog",
-        medicalAlerts: [{ type: "seizure", description: "xyz", severity: "critical" }],
-      }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("accepts valid temperamentScore 1–5", async () => {
-    const app = createApp();
-    for (const score of [1, 2, 3, 4, 5]) {
-      resetMock();
-      const res = await app.request("/pets", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: score }),
-      });
-      expect(res.status).toBe(201);
-    }
-  });
-
-  it("accepts all valid medicalAlert severity values", async () => {
-    const app = createApp();
-    for (const severity of ["low", "medium", "high"] as const) {
-      resetMock();
-      const res = await app.request("/pets", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          clientId: CLIENT_ID,
-          name: "Test",
-          species: "dog",
-          medicalAlerts: [{ type: "allergy", description: "Sensitive to chicken", severity }],
-        }),
-      });
-      expect(res.status).toBe(201);
-    }
-  });
-});
-
-describe("Extended pet profile fields — create", () => {
-  beforeEach(resetMock);
-
-  it("accepts all extended fields on create", async () => {
-    const app = createApp();
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        clientId: CLIENT_ID,
-        name: "Biscuit",
-        species: "dog",
-        breed: "Golden Retriever",
-        coatType: "double",
-        temperamentScore: 4,
-        temperamentFlags: ["anxious_with_dryers", "gentle"],
-        medicalAlerts: [
-          { type: "seizure", description: "Occasional episodes", severity: "medium" },
-        ],
-        preferredCuts: ["puppy cut", "teddy bear"],
-      }),
-    });
-    expect(res.status).toBe(201);
-    const body = await res.json();
-    expect(body.coatType).toBe("double");
-    expect(body.temperamentScore).toBe(4);
-    expect(body.temperamentFlags).toEqual(["anxious_with_dryers", "gentle"]);
-    expect(body.medicalAlerts).toEqual([{ type: "seizure", description: "Occasional episodes", severity: "medium" }]);
-    expect(body.preferredCuts).toEqual(["puppy cut", "teddy bear"]);
-  });
-
-  it("create without extended fields works (all optional)", async () => {
-    const app = createApp();
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Basil", species: "cat" }),
-    });
-    expect(res.status).toBe(201);
-  });
-});
-
-describe("Extended pet profile fields — update", () => {
-  beforeEach(resetMock);
-
-  it("updates coatType", async () => {
-    const app = createApp();
-    const res = await app.request(`/pets/${PET_ID}`, {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ coatType: "smooth" }),
-    });
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.coatType).toBe("smooth");
-  });
-
-  it("updates temperamentScore", async () => {
-    const app = createApp();
-    const res = await app.request(`/pets/${PET_ID}`, {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ temperamentScore: 2 }),
-    });
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.temperamentScore).toBe(2);
-  });
-
-  it("rejects temperamentScore 0 on update", async () => {
-    const app = createApp();
-    const res = await app.request(`/pets/${PET_ID}`, {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ temperamentScore: 0 }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("rejects invalid severity on update", async () => {
-    const app = createApp();
-    const res = await app.request(`/pets/${PET_ID}`, {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        medicalAlerts: [{ type: "x", description: "y", severity: "urgent" }],
-      }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("rejects too many temperamentFlags (>20)", async () => {
-    const app = createApp();
-    const flags = Array.from({ length: 21 }, (_, i) => `flag_${i}`);
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentFlags: flags }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("rejects too many preferredCuts (>20)", async () => {
-    const app = createApp();
-    const cuts = Array.from({ length: 21 }, (_, i) => `cut_${i}`);
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", preferredCuts: cuts }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("rejects too many medicalAlerts (>50)", async () => {
-    const app = createApp();
-    const alerts = Array.from({ length: 51 }, (_, i) => ({
-      type: `type_${i}`,
-      description: `desc_${i}`,
-      severity: "low" as const,
-    }));
-    const res = await app.request("/pets", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", medicalAlerts: alerts }),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  it("returns extended fields in GET response", async () => {
-    petRows = [{ ...petRows[0], coatType: "wire", temperamentScore: 3, temperamentFlags: ["gentle"], medicalAlerts: [], preferredCuts: ["scissor cut"] }];
-    const app = createApp();
-    const res = await app.request(`/pets/${PET_ID}`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.coatType).toBe("wire");
-    expect(body.temperamentScore).toBe(3);
-    expect(body.temperamentFlags).toEqual(["gentle"]);
-    expect(body.preferredCuts).toEqual(["scissor cut"]);
-  });
-});

apps/api/src/__tests__/seed-uat-credentials.test.ts

@@ -1,431 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-
-// ─── Test configuration constants (must match seed.ts) ─────────────────────────
-
-const UAT_ACCOUNTS = [
-  {
-    email: "uat-super@groombook.dev",
-    name: "UAT Super User",
-    passwordEnv: "SEED_UAT_SUPER_PASSWORD",
-    staffEmail: "uat-super@groombook.dev",
-  },
-  {
-    email: "uat-groomer@groombook.dev",
-    name: "UAT Staff Groomer",
-    passwordEnv: "SEED_UAT_GROOMER_PASSWORD",
-    staffEmail: "uat-groomer@groombook.dev",
-  },
-  {
-    email: "uat-customer@groombook.dev",
-    name: "UAT Customer",
-    passwordEnv: "SEED_UAT_CUSTOMER_PASSWORD",
-    staffEmail: null,
-  },
-  {
-    email: "uat-tester@groombook.dev",
-    name: "UAT Tester",
-    passwordEnv: "SEED_UAT_TESTER_PASSWORD",
-    staffEmail: "uat-tester@groombook.dev",
-  },
-];
-
-const TEST_PASSWORD = "test-password-123";
-
-// ─── Password hashing — must match better-auth/crypto (N=16384, r=16, p=1, dkLen=64, hex) ───
-
-async function hashPassword(password: string): Promise<string> {
-  const { hashPassword } = await import("better-auth/crypto");
-  return hashPassword(password);
-}
-
-// ─── Mock DB state ─────────────────────────────────────────────────────────────
-
-interface UserRow {
-  id: string;
-  email: string;
-  name: string;
-  emailVerified: boolean;
-}
-
-interface AccountRow {
-  id: string;
-  accountId: string;
-  providerId: string;
-  userId: string;
-  password: string | null;
-}
-
-interface StaffRow {
-  id: string;
-  email: string;
-  userId: string | null;
-  name: string;
-}
-
-let dbUsers: UserRow[] = [];
-let dbAccounts: AccountRow[] = [];
-let dbStaff: StaffRow[] = [];
-let insertedUsers: UserRow[] = [];
-let insertedAccounts: AccountRow[] = [];
-let updatedStaff: Array<{ id: string; userId: string }> = [];
-
-const originalEnv = { ...process.env };
-
-function resetMock() {
-  dbUsers = [];
-  dbAccounts = [];
-  dbStaff = [];
-  insertedUsers = [];
-  insertedAccounts = [];
-  updatedStaff = [];
-  process.env = { ...originalEnv };
-}
-
-// ─── Mock schema ───────────────────────────────────────────────────────────────
-
-function makeSchemaMock() {
-  const user = new Proxy({ _name: "user" }, {
-    get(_t, p) {
-      if (p === "_name") return "user";
-      if (p === "$inferSelect") return {};
-      return { table: "user", column: p };
-    },
-  });
-
-  const account = new Proxy({ _name: "account" }, {
-    get(_t, p) {
-      if (p === "_name") return "account";
-      if (p === "$inferSelect") return {};
-      return { table: "account", column: p };
-    },
-  });
-
-  const staff = new Proxy({ _name: "staff" }, {
-    get(_t, p) {
-      if (p === "_name") return "staff";
-      if (p === "$inferSelect") return {};
-      return { table: "staff", column: p };
-    },
-  });
-
-  return { user, account, staff };
-}
-
-const { user: mockUser, account: mockAccount, staff: mockStaff } = makeSchemaMock();
-
-function eq(col: unknown, val: unknown) {
-  return { __type: "eq" as const, col, val };
-}
-
-function and(...conds: unknown[]) {
-  return { __type: "and" as const, conds };
-}
-
-// ─── Seed logic helper ─────────────────────────────────────────────────────────
-// Inline the credential provisioning logic under test so we can call it directly.
-// This is the same logic as seed.ts lines 514-598.
-
-interface SeedAccount {
-  email: string;
-  name: string;
-  passwordEnv: string;
-  staffEmail: string | null;
-}
-
-let uuidCounter = 0;
-function mockUuid(): string {
-  return `mock-uuid-${++uuidCounter}`;
-}
-
-async function seedUatCredentials(
-  accounts: SeedAccount[],
-  opts: {
-    users?: UserRow[];
-    accounts?: AccountRow[];
-    staff?: StaffRow[];
-  }
-) {
-  const { users = dbUsers, accounts: accts = dbAccounts, staff: staffRows = dbStaff } = opts;
-
-  for (const acct of accounts) {
-    const password = process.env[acct.passwordEnv];
-    if (!password) {
-      console.warn(`⚠ Skipping ${acct.email} — ${acct.passwordEnv} not set`);
-      continue;
-    }
-
-    // 1. Find or create the Better-Auth user
-    const existingUser = users.find((u) => u.email === acct.email);
-
-    let userId: string;
-    if (existingUser) {
-      userId = existingUser.id;
-    } else {
-      userId = mockUuid();
-      const newUser: UserRow = { id: userId, name: acct.name, email: acct.email, emailVerified: true };
-      insertedUsers.push(newUser);
-      dbUsers.push(newUser);
-    }
-
-    // 2. Check if credential account already exists
-    const existingAccount = accts.find(
-      (a) => a.userId === userId && a.providerId === "credential"
-    );
-
-    if (existingAccount) {
-      // skip — already has credential account
-    } else {
-      // Use Better-Auth's hashPassword so test helper matches production seed.ts
-      const { hashPassword } = await import("better-auth/crypto");
-      const passwordHash = await hashPassword(password);
-
-      const newAccount: AccountRow = {
-        id: mockUuid(),
-        accountId: userId,
-        providerId: "credential",
-        userId,
-        password: passwordHash,
-      };
-      insertedAccounts.push(newAccount);
-      dbAccounts.push(newAccount);
-    }
-
-    // 3. Link staff record to Better-Auth user
-    if (acct.staffEmail) {
-      const existingStaff = staffRows.find((s) => s.email === acct.staffEmail);
-      if (existingStaff && !existingStaff.userId) {
-        existingStaff.userId = userId;
-        updatedStaff.push({ id: existingStaff.id, userId });
-      }
-    }
-  }
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("seedUatCredentials — credential provisioning logic", () => {
-  beforeEach(() => {
-    resetMock();
-    uuidCounter = 0;
-  });
-
-  afterEach(() => {
-    process.env = { ...originalEnv };
-  });
-
-  // ── AC-1: creates user + account when neither exists ──────────────────────
-
-  it("AC-1: creates user and account for each UAT account with password env var set", async () => {
-    process.env.SEED_UAT_SUPER_PASSWORD = TEST_PASSWORD;
-    process.env.SEED_UAT_GROOMER_PASSWORD = TEST_PASSWORD;
-    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
-    process.env.SEED_UAT_TESTER_PASSWORD = TEST_PASSWORD;
-
-    await seedUatCredentials(UAT_ACCOUNTS, { users: [], accounts: [], staff: [] });
-
-    // 4 users created (customer + tester have no staff, super + groomer do)
-    expect(insertedUsers).toHaveLength(4);
-    expect(insertedUsers.find((u) => u.email === "uat-super@groombook.dev")).toBeDefined();
-    expect(insertedUsers.find((u) => u.email === "uat-groomer@groombook.dev")).toBeDefined();
-    expect(insertedUsers.find((u) => u.email === "uat-customer@groombook.dev")).toBeDefined();
-    expect(insertedUsers.find((u) => u.email === "uat-tester@groombook.dev")).toBeDefined();
-
-    // 4 accounts created
-    expect(insertedAccounts).toHaveLength(4);
-    for (const acct of insertedAccounts) {
-      expect(acct.providerId).toBe("credential");
-      // Better-Auth uses hex encoding: saltHex:keyHex (both lowercase hex)
-      expect(acct.password).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
-      // Verify the hash is scrypt with correct params (N=16384, r=16, p=1, dkLen=64)
-      const parts = acct.password!.split(":");
-      const saltHex = parts[0]!;
-      const keyHex = parts[1]!;
-      const salt = Buffer.from(saltHex, "hex");
-      const storedHash = Buffer.from(keyHex, "hex");
-      expect(salt).toHaveLength(16);
-      expect(storedHash).toHaveLength(64);
-    }
-  });
-
-  // ── AC-2: emailVerified = true ─────────────────────────────────────────────
-
-  it("AC-2: created users have emailVerified = true", async () => {
-    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
-
-    await seedUatCredentials(
-      [UAT_ACCOUNTS[2]!], // customer only
-      { users: [], accounts: [], staff: [] }
-    );
-
-    expect(insertedUsers[0]!.emailVerified).toBe(true);
-  });
-
-  // ── AC-3: providerId = credential, password is hashed ──────────────────────
-
-  it("AC-3: account records use providerId='credential' with properly formatted hashed password", async () => {
-    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
-
-    await seedUatCredentials(
-      [UAT_ACCOUNTS[2]!],
-      { users: [], accounts: [], staff: [] }
-    );
-
-    const acct = insertedAccounts[0]!;
-    expect(acct.providerId).toBe("credential");
-    // Better-Auth uses hex: saltHex (32 chars) : keyHex (128 chars)
-    expect(acct.password).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
-    const parts = acct.password!.split(":");
-    const saltHex = parts[0]!;
-    const keyHex = parts[1]!;
-    expect(() => Buffer.from(saltHex, "hex")).not.toThrow();
-    expect(() => Buffer.from(keyHex, "hex")).not.toThrow();
-    const salt = Buffer.from(saltHex, "hex");
-    const storedHash = Buffer.from(keyHex, "hex");
-    expect(salt).toHaveLength(16);
-    expect(storedHash).toHaveLength(64);
-  });
-
-  // ── AC-4: staff.userId is linked ────────────────────────────────────────────
-
-  it("AC-4: links staff.userId to the Better-Auth user when staff record exists", async () => {
-    process.env.SEED_UAT_SUPER_PASSWORD = TEST_PASSWORD;
-    const staffRows: StaffRow[] = [
-      { id: "staff-super-1", email: "uat-super@groombook.dev", userId: null, name: "UAT Super User" },
-    ];
-
-    await seedUatCredentials([UAT_ACCOUNTS[0]!], { users: [], accounts: [], staff: staffRows });
-
-    expect(updatedStaff).toHaveLength(1);
-    expect(updatedStaff[0]!.id).toBe("staff-super-1");
-    expect(updatedStaff[0]!.userId).toBe("mock-uuid-1");
-    expect(staffRows[0]!.userId).toBe("mock-uuid-1");
-  });
-
-  it("AC-4b: does not update staff.userId if already set", async () => {
-    process.env.SEED_UAT_GROOMER_PASSWORD = TEST_PASSWORD;
-    const staffRows: StaffRow[] = [
-      { id: "staff-groomer-1", email: "uat-groomer@groombook.dev", userId: "already-linked", name: "UAT Groomer" },
-    ];
-
-    await seedUatCredentials([UAT_ACCOUNTS[1]!], { users: [], accounts: [], staff: staffRows });
-
-    expect(updatedStaff).toHaveLength(0);
-  });
-
-  // ── AC-5: idempotent — skips when user already exists ───────────────────────
-
-  it("AC-5: re-running does not duplicate user or account records (idempotent)", async () => {
-    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
-
-    const preExistingUsers: UserRow[] = [
-      { id: "pre-existing-user", email: "uat-customer@groombook.dev", name: "UAT Customer", emailVerified: true },
-    ];
-    const preExistingAccounts: AccountRow[] = [
-      {
-        id: "pre-existing-acct",
-        accountId: "pre-existing-user",
-        providerId: "credential",
-        userId: "pre-existing-user",
-        password: await hashPassword(TEST_PASSWORD),
-      },
-    ];
-
-    // First call — nothing inserted (user + account pre-exist)
-    await seedUatCredentials([UAT_ACCOUNTS[2]!], {
-      users: preExistingUsers,
-      accounts: preExistingAccounts,
-      staff: [],
-    });
-
-    expect(insertedUsers).toHaveLength(0);
-    expect(insertedAccounts).toHaveLength(0);
-
-    // Second call — still nothing inserted
-    await seedUatCredentials([UAT_ACCOUNTS[2]!], {
-      users: preExistingUsers,
-      accounts: preExistingAccounts,
-      staff: [],
-    });
-
-    expect(insertedUsers).toHaveLength(0);
-    expect(insertedAccounts).toHaveLength(0);
-  });
-
-  // ── AC-6: missing env var skips with warning ────────────────────────────────
-
-  it("AC-6: missing SEED_UAT_*_PASSWORD env var skips that account (no error)", async () => {
-    // No env vars set at all
-    delete process.env.SEED_UAT_SUPER_PASSWORD;
-    delete process.env.SEED_UAT_GROOMER_PASSWORD;
-    delete process.env.SEED_UAT_CUSTOMER_PASSWORD;
-    delete process.env.SEED_UAT_TESTER_PASSWORD;
-
-    const warnSpy = vi.spyOn(console, "warn").mockReturnValue(undefined);
-
-    await seedUatCredentials(UAT_ACCOUNTS, { users: [], accounts: [], staff: [] });
-
-    // Nothing created
-    expect(insertedUsers).toHaveLength(0);
-    expect(insertedAccounts).toHaveLength(0);
-    // Warning logged for each of the 4 accounts
-    expect(warnSpy).toHaveBeenCalledTimes(4);
-    expect(warnSpy).toHaveBeenCalledWith(
-      "⚠ Skipping uat-super@groombook.dev — SEED_UAT_SUPER_PASSWORD not set"
-    );
-
-    warnSpy.mockRestore();
-  });
-
-  // ── AC-7: partial env var coverage ─────────────────────────────────────────
-
-  it("AC-7: only accounts with password env var set are provisioned", async () => {
-    process.env.SEED_UAT_SUPER_PASSWORD = TEST_PASSWORD;
-    // Only super has password set
-
-    const warnSpy = vi.spyOn(console, "warn").mockReturnValue(undefined);
-
-    await seedUatCredentials(UAT_ACCOUNTS, { users: [], accounts: [], staff: [] });
-
-    expect(insertedUsers).toHaveLength(1);
-    expect(insertedUsers[0]!.email).toBe("uat-super@groombook.dev");
-    expect(insertedAccounts).toHaveLength(1);
-    expect(insertedAccounts[0]!.accountId).toBe("mock-uuid-1");
-
-    // 3 warnings for missing accounts
-    expect(warnSpy).toHaveBeenCalledTimes(3);
-
-    warnSpy.mockRestore();
-  });
-});
-
-// ─── Password hash format verification ───────────────────────────────────────
-
-describe("password hash format — scrypt parameters", () => {
-  it("hashes use salt:hash format with 16-byte salt and 64-byte output", async () => {
-    const hash = await hashPassword("test-password");
-    const parts = hash.split(":");
-    const saltHex = parts[0]!;
-    const keyHex = parts[1]!;
-
-    expect(hash).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
-    expect(Buffer.from(saltHex, "hex")).toHaveLength(16);
-    expect(Buffer.from(keyHex, "hex")).toHaveLength(64);
-  });
-
-  it("same password produces different hashes (due to random salt)", async () => {
-    const hash1 = await hashPassword("same-password");
-    const hash2 = await hashPassword("same-password");
-
-    expect(hash1).not.toBe(hash2);
-    // Both are valid Better-Auth hex format
-    expect(hash1).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
-    expect(hash2).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
-  });
-
-  it("different passwords produce different hashes", async () => {
-    const hash1 = await hashPassword("password1");
-    const hash2 = await hashPassword("password2");
-
-    expect(hash1).not.toBe(hash2);
-  });
-});

package.json

@@ -3,5 +3,40 @@
   "version": "0.0.1",
   "private": true,
   "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "lint": "eslint src --ext .ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.800.0",
+    "@aws-sdk/s3-request-presigner": "^3.800.0",
+    "@groombook/db": "workspace:*",
+    "@groombook/types": "workspace:*",
+    "@hono/node-server": "^1.13.7",
+    "@hono/zod-validator": "^0.7.6",
+    "better-auth": "^1.5.6",
+    "hono": "^4.6.17",
+    "node-cron": "^3.0.3",
+    "nodemailer": "^6.9.16",
+    "stripe": "^22.0.0",
+    "telnyx": "^1.23.0",
+
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.7",
+    "@types/node-cron": "^3.0.11",
+    "@types/nodemailer": "^6.4.17",
+    "@vitest/coverage-v8": "^3.2.4",
+    "eslint": "^9.18.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^3.2.4"
+  },
   "license": "AGPL-3.0-only"
 }

packages/db/drizzle.config.ts

@@ -1,7 +1,7 @@
 import { defineConfig } from "drizzle-kit";
 
 export default defineConfig({
-  schema: "./src/db/schema.ts",
+  schema: "./src/schema.ts",
   out: "./migrations",
   dialect: "postgresql",
   dbCredentials: {

packages/db/migrations/0030_messaging.sql

@@ -0,0 +1,72 @@
+-- Migration: 0030_messaging.sql
+-- Messaging schema: conversations, messages, attachments, consent events + business messaging settings
+
+-- ─── Enums ───────────────────────────────────────────────────────────────────
+
+CREATE TYPE "messaging_channel" AS ENUM ('sms', 'mms');
+CREATE TYPE "message_direction" AS ENUM ('inbound', 'outbound');
+CREATE TYPE "message_status" AS ENUM ('queued', 'sent', 'delivered', 'failed', 'received');
+CREATE TYPE "message_consent_kind" AS ENUM ('opt_in', 'opt_out', 'help');
+
+-- ─── Tables ───────────────────────────────────────────────────────────────────
+
+CREATE TABLE "conversations" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "business_id" uuid NOT NULL,
+  "client_id" uuid NOT NULL REFERENCES "clients"("id") ON DELETE CASCADE,
+  "channel" "messaging_channel" NOT NULL,
+  "external_number" text NOT NULL,
+  "business_number" text NOT NULL,
+  "last_message_at" timestamp,
+  "status" text NOT NULL DEFAULT 'active',
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "updated_at" timestamp NOT NULL DEFAULT now()
+);
+
+CREATE INDEX "idx_conversations_business_id_last_message_at" ON "conversations"("business_id", "last_message_at" DESC);
+CREATE UNIQUE INDEX "uq_conversations_business_client_number" ON "conversations"("business_id", "client_id", "business_number");
+
+CREATE TABLE "messages" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "conversation_id" uuid NOT NULL REFERENCES "conversations"("id") ON DELETE CASCADE,
+  "direction" "message_direction" NOT NULL,
+  "body" text,
+  "status" "message_status" NOT NULL DEFAULT 'queued',
+  "provider_message_id" text,
+  "error_code" text,
+  "error_message" text,
+  "sent_by_staff_id" uuid REFERENCES "staff"("id") ON DELETE SET NULL,
+  "created_at" timestamp NOT NULL DEFAULT now(),
+  "delivered_at" timestamp,
+  "read_by_client_at" timestamp
+);
+
+CREATE INDEX "idx_messages_conversation_id_created_at" ON "messages"("conversation_id", "created_at" DESC);
+CREATE UNIQUE INDEX "uq_messages_provider_message_id" ON "messages"("provider_message_id");
+
+CREATE TABLE "message_attachments" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "message_id" uuid NOT NULL REFERENCES "messages"("id") ON DELETE CASCADE,
+  "content_type" text NOT NULL,
+  "url" text NOT NULL,
+  "size" integer NOT NULL,
+  "provider_media_id" text
+);
+
+CREATE INDEX "idx_message_attachments_message_id" ON "message_attachments"("message_id");
+
+CREATE TABLE "message_consent_events" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "client_id" uuid NOT NULL REFERENCES "clients"("id") ON DELETE CASCADE,
+  "business_id" uuid NOT NULL,
+  "kind" "message_consent_kind" NOT NULL,
+  "source" text,
+  "created_at" timestamp NOT NULL DEFAULT now()
+);
+
+CREATE INDEX "idx_message_consent_events_client_id" ON "message_consent_events"("client_id");
+
+-- ─── Business Settings extensions ────────────────────────────────────────────
+
+ALTER TABLE "business_settings" ADD COLUMN "messaging_phone_number" text;
+ALTER TABLE "business_settings" ADD COLUMN "telnyx_messaging_profile_id" text;

packages/db/migrations/meta/_journal.json

@@ -208,15 +208,15 @@
     {
       "idx": 29,
       "version": "7",
-      "when": 1775828067192,
+      "when": 1775784467192,
       "tag": "0029_db_indexes_constraints",
       "breakpoints": true
     },
     {
       "idx": 30,
       "version": "7",
-      "when": 1775914467192,
-      "tag": "0030_extended_pet_profile",
+      "when": 1775828067192,
+      "tag": "0030_messaging",
       "breakpoints": true
     }
   ]

packages/db/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@groombook/db",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": {
+      "default": "./dist/index.js",
+      "types": "./src/index.ts"
+    },
+    "./factories": {
+      "default": "./src/factories.ts",
+      "types": "./src/factories.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "generate": "drizzle-kit generate",
+    "migrate": "drizzle-kit migrate",
+    "seed": "tsx src/seed.ts",
+    "reset": "tsx src/reset.ts && drizzle-kit migrate && tsx src/seed.ts",
+    "studio": "drizzle-kit studio",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.38.4",
+    "postgres": "^3.4.5"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.7",
+    "drizzle-kit": "^0.30.4",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.3"
+  },
+  "license": "AGPL-3.0-only"
+}

packages/db/src/factories.ts

@@ -8,7 +8,7 @@
  * readable values (e.g. "staff-1", "client-2") without needing crypto.
  *
  * Usage:
- *   import { buildStaff, buildClient, buildPet } from "./db/factories";
+ *   import { buildStaff, buildClient, buildPet } from "@groombook/db/factories";
  *
  *   const manager = buildStaff({ role: "manager" });
  *   const client  = buildClient({ name: "Alice Smith" });
@@ -103,11 +103,6 @@ export function buildPet(overrides: Partial<PetRow> & { clientId: string }): Pet
     photoKey: null,
     photoUploadedAt: null,
     image: null,
-    coatType: null,
-    temperamentScore: null,
-    temperamentFlags: [],
-    medicalAlerts: [],
-    preferredCuts: [],
     createdAt: new Date("2025-01-01T00:00:00Z"),
     updatedAt: new Date("2025-01-01T00:00:00Z"),
   };

packages/db/src/schema.ts

@@ -12,16 +12,6 @@ import {
   uuid,
 } from "drizzle-orm/pg-core";
 
-// ─── Shared types ───────────────────────────────────────────────────────────────
-
-export type MedicalAlertSeverity = "low" | "medium" | "high";
-
-export interface MedicalAlert {
-  type: string;
-  description: string;
-  severity: MedicalAlertSeverity;
-}
-
 // ─── Enums ────────────────────────────────────────────────────────────────────
 
 export const appointmentStatusEnum = pgEnum("appointment_status", [
@@ -156,12 +146,6 @@ export const pets = pgTable(
     photoKey: text("photo_key"),
     photoUploadedAt: timestamp("photo_uploaded_at"),
     image: text("image"),
-    // Extended profile fields
-    coatType: text("coat_type"),
-    temperamentScore: integer("temperament_score"),
-    temperamentFlags: jsonb("temperament_flags").$type<string[]>().default([]),
-    medicalAlerts: jsonb("medical_alerts").$type<MedicalAlert[]>().default([]),
-    preferredCuts: jsonb("preferred_cuts").$type<string[]>().default([]),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
   },
@@ -422,6 +406,117 @@ export const impersonationAuditLogs = pgTable(
   (t) => [index("impersonation_audit_logs_session_id_idx").on(t.sessionId)]
 );
 
+// ─── Messaging ───────────────────────────────────────────────────────────────
+
+export const messagingChannelEnum = pgEnum("messaging_channel", ["sms", "mms"]);
+
+export const messageDirectionEnum = pgEnum("message_direction", [
+  "inbound",
+  "outbound",
+]);
+
+export const messageStatusEnum = pgEnum("message_status", [
+  "queued",
+  "sent",
+  "delivered",
+  "failed",
+  "received",
+]);
+
+export const messageConsentKindEnum = pgEnum("message_consent_kind", [
+  "opt_in",
+  "opt_out",
+  "help",
+]);
+
+export const conversations = pgTable(
+  "conversations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    businessId: uuid("business_id").notNull(),
+    clientId: uuid("client_id")
+      .notNull()
+      .references(() => clients.id, { onDelete: "cascade" }),
+    channel: messagingChannelEnum("channel").notNull(),
+    externalNumber: text("external_number").notNull(),
+    businessNumber: text("business_number").notNull(),
+    lastMessageAt: timestamp("last_message_at"),
+    status: text("status").notNull().default("active"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (t) => [
+    index("idx_conversations_business_id_last_message_at").on(
+      t.businessId,
+      t.lastMessageAt.desc()
+    ),
+    unique("uq_conversations_business_client_number").on(
+      t.businessId,
+      t.clientId,
+      t.businessNumber
+    ),
+  ]
+);
+
+export const messages = pgTable(
+  "messages",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    conversationId: uuid("conversation_id")
+      .notNull()
+      .references(() => conversations.id, { onDelete: "cascade" }),
+    direction: messageDirectionEnum("direction").notNull(),
+    body: text("body"),
+    status: messageStatusEnum("status").notNull().default("queued"),
+    providerMessageId: text("provider_message_id"),
+    errorCode: text("error_code"),
+    errorMessage: text("error_message"),
+    sentByStaffId: uuid("sent_by_staff_id").references(() => staff.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    deliveredAt: timestamp("delivered_at"),
+    readByClientAt: timestamp("read_by_client_at"),
+  },
+  (t) => [
+    index("idx_messages_conversation_id_created_at").on(
+      t.conversationId,
+      t.createdAt.desc()
+    ),
+    unique("uq_messages_provider_message_id").on(t.providerMessageId),
+  ]
+);
+
+export const messageAttachments = pgTable(
+  "message_attachments",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    messageId: uuid("message_id")
+      .notNull()
+      .references(() => messages.id, { onDelete: "cascade" }),
+    contentType: text("content_type").notNull(),
+    url: text("url").notNull(),
+    size: integer("size").notNull(),
+    providerMediaId: text("provider_media_id"),
+  },
+  (t) => [index("idx_message_attachments_message_id").on(t.messageId)]
+);
+
+export const messageConsentEvents = pgTable(
+  "message_consent_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    clientId: uuid("client_id")
+      .notNull()
+      .references(() => clients.id, { onDelete: "cascade" }),
+    businessId: uuid("business_id").notNull(),
+    kind: messageConsentKindEnum("kind").notNull(),
+    source: text("source"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+  },
+  (t) => [index("idx_message_consent_events_client_id").on(t.clientId)]
+);
+
 export const businessSettings = pgTable("business_settings", {
   id: uuid("id").primaryKey().defaultRandom(),
   businessName: text("business_name").notNull().default("GroomBook"),
@@ -430,6 +525,8 @@ export const businessSettings = pgTable("business_settings", {
   logoKey: text("logo_key"),
   primaryColor: text("primary_color").notNull().default("#4f8a6f"),
   accentColor: text("accent_color").notNull().default("#8b7355"),
+  messagingPhoneNumber: text("messaging_phone_number"),
+  telnyxMessagingProfileId: text("telnyx_messaging_profile_id"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
   updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });

packages/db/src/seed.ts

@@ -18,7 +18,7 @@
 
 import postgres from "postgres";
 import { drizzle } from "drizzle-orm/postgres-js";
-import { eq, and, sql } from "drizzle-orm";
+import { eq, sql } from "drizzle-orm";
 import * as schema from "./schema.js";
 
 // ── Seed profile configuration ─────────────────────────────────────────────
@@ -94,6 +94,11 @@ function pick<T>(arr: T[]): T {
   return arr[Math.floor(rand() * arr.length)]!;
 }
 
+/** Return n distinct random elements from an array. */
+function pickN<T>(arr: T[], n: number): T[] {
+  const shuffled = [...arr].sort(() => rand() - 0.5);
+  return shuffled.slice(0, n);
+}
 
 function randInt(min: number, max: number): number {
   return Math.floor(rand() * (max - min + 1)) + min;
@@ -454,32 +459,6 @@ async function seedKnownUsers() {
     }
   }
 
-  // ── Staff: UAT Tester (oidcSub from SEED_UAT_TESTER_OIDC_SUB env var) ──
-  const uatTesterOidcSub = process.env.SEED_UAT_TESTER_OIDC_SUB;
-  if (uatTesterOidcSub) {
-    const UAT_TESTER_STAFF_ID = "00000000-0000-0000-0000-000000000007";
-    const [existingUatTester] = await db
-      .select()
-      .from(schema.staff)
-      .where(eq(schema.staff.email, "uat-tester@groombook.dev"))
-      .limit(1);
-
-    if (existingUatTester) {
-      console.log(`✓ Staff 'UAT Tester' already exists — skipping`);
-    } else {
-      await db.insert(schema.staff).values({
-        id: UAT_TESTER_STAFF_ID,
-        name: "UAT Tester",
-        email: "uat-tester@groombook.dev",
-        oidcSub: uatTesterOidcSub,
-        role: "groomer",
-        isSuperUser: false,
-        active: true,
-      });
-      console.log(`✓ Created staff 'UAT Tester' (oidcSub: ${uatTesterOidcSub})`);
-    }
-  }
-
   // ── Staff: UAT Groomer Personas (SEED_UAT_GROOMER_EMAILS + SEED_UAT_GROOMER_NAMES) ──
   const groomerEmails = process.env.SEED_UAT_GROOMER_EMAILS?.split(",").map((e) => e.trim()).filter(Boolean) ?? [];
   const groomerNames = process.env.SEED_UAT_GROOMER_NAMES?.split(",").map((n) => n.trim()).filter(Boolean) ?? [];
@@ -511,90 +490,6 @@ async function seedKnownUsers() {
     }
   }
 
-  // ── Better-Auth email+password credentials for UAT accounts ──────────────────
-  // Provisions Better-Auth user + account records so UAT testers can log in
-  // via email+password (POST /api/auth/sign-in/email) instead of Authentik SSO.
-  const uatPasswordAccounts = [
-    { email: "uat-super@groombook.dev", name: "UAT Super User", passwordEnv: "SEED_UAT_SUPER_PASSWORD", staffEmail: "uat-super@groombook.dev" },
-    { email: "uat-groomer@groombook.dev", name: "UAT Staff Groomer", passwordEnv: "SEED_UAT_GROOMER_PASSWORD", staffEmail: "uat-groomer@groombook.dev" },
-    { email: "uat-customer@groombook.dev", name: "UAT Customer", passwordEnv: "SEED_UAT_CUSTOMER_PASSWORD", staffEmail: null },
-    { email: "uat-tester@groombook.dev", name: "UAT Tester", passwordEnv: "SEED_UAT_TESTER_PASSWORD", staffEmail: "uat-tester@groombook.dev" },
-  ];
-
-  for (const acct of uatPasswordAccounts) {
-    const password = process.env[acct.passwordEnv];
-    if (!password) {
-      console.warn(`⚠ Skipping ${acct.email} — ${acct.passwordEnv} not set`);
-      continue;
-    }
-
-    // 1. Find or create the Better-Auth user
-    const [existingUser] = await db
-      .select()
-      .from(schema.user)
-      .where(eq(schema.user.email, acct.email))
-      .limit(1);
-
-    let userId: string;
-    if (existingUser) {
-      userId = existingUser.id;
-      console.log(`✓ Better-Auth user '${acct.name}' already exists — skipping user creation`);
-    } else {
-      userId = uuid();
-      await db.insert(schema.user).values({
-        id: userId,
-        name: acct.name,
-        email: acct.email,
-        emailVerified: true,
-      });
-      console.log(`✓ Created Better-Auth user '${acct.name}' (${acct.email})`);
-    }
-
-    // 2. Check if credential account already exists
-    const [existingAccount] = await db
-      .select()
-      .from(schema.account)
-      .where(and(
-        eq(schema.account.userId, userId),
-        eq(schema.account.providerId, "credential")
-      ))
-      .limit(1);
-
-    if (existingAccount) {
-      console.log(`✓ Credential account for '${acct.email}' already exists — skipping`);
-    } else {
-      // Use Better-Auth's own hashPassword to guarantee parameter/encoding match.
-      // better-auth/crypto uses: N=16384, r=16, p=1, dkLen=64, salt as 16-byte random
-      // hex string, key hex-encoded, format saltHex:keyHex.
-      const { hashPassword } = await import("better-auth/crypto");
-      const passwordHash = await hashPassword(password);
-
-      await db.insert(schema.account).values({
-        id: uuid(),
-        accountId: userId,
-        providerId: "credential",
-        userId,
-        password: passwordHash,
-      });
-      console.log(`✓ Created credential account for '${acct.email}'`);
-    }
-
-    // 3. Link staff record to Better-Auth user (for accounts that have staff records)
-    if (acct.staffEmail) {
-      const [existingStaff] = await db
-        .select()
-        .from(schema.staff)
-        .where(eq(schema.staff.email, acct.staffEmail))
-        .limit(1);
-      if (existingStaff && !existingStaff.userId) {
-        await db.update(schema.staff)
-          .set({ userId })
-          .where(eq(schema.staff.id, existingStaff.id));
-        console.log(`✓ Linked staff '${acct.staffEmail}' → Better-Auth user`);
-      }
-    }
-  }
-
   // ── Services: idempotent upsert using name as unique key ─────────────────────
   // UNIQUE constraint on services.name (migration 0020) must exist first.
   // Uses b0000001-... IDs to match main seed servicesDef for same-named services.
@@ -988,7 +883,6 @@ async function seed() {
   let appointmentCount = 0;
   let invoiceCount = 0;
   let visitLogCount = 0;
-  let paidInvoiceCounter = 0;
 
   // Process in batches per client to keep memory manageable
   const apptBatchSize = 100;
@@ -1083,11 +977,8 @@ async function seed() {
 
         const invoiceStatus = rand() < 0.95 ? "paid" as const : "pending" as const;
         const paidAt = invoiceStatus === "paid" ? new Date(endTime.getTime() + randInt(5, 30) * 60 * 1000) : null;
-        paidInvoiceCounter++;
-        const stripePaymentIntentId = invoiceStatus === "paid"
-          ? `pi_test_seed_${String(paidInvoiceCounter).padStart(6, "0")}`
-          : null;
 
+        const stripePaymentIntentId = invoiceStatus === "paid" && rand() < 0.2 ? `pi_test_${uuid().replace(/-/g, "").slice(0, 24)}` : null;
         invoiceBatch.push({
           id: invoiceId,
           appointmentId: apptId,
@@ -1184,7 +1075,7 @@ async function seed() {
       const groomer = pick(groomers);
       const bather = bathers.length > 0 && rand() < 0.6 ? pick(bathers) : null;
 
-      const startTime = randDate(appointmentsBackDate, now);
+      let startTime = randDate(appointmentsBackDate, now);
       startTime.setHours(randInt(8, 16), pick([0, 15, 30, 45]), 0, 0);
       const endTime = new Date(startTime.getTime() + svc.dur * 60 * 1000);
       const effectivePrice = svc.price;
@@ -1203,16 +1094,14 @@ async function seed() {
       const taxCents = Math.round(effectivePrice * 0.08);
       const totalCents = effectivePrice + taxCents + tipCents;
       const paidAt = new Date(endTime.getTime() + randInt(5, 30) * 60 * 1000);
-      paidInvoiceCounter++;
+      const stripePaymentIntentId = rand() < 0.2 ? `pi_test_${uuid().replace(/-/g, "").slice(0, 24)}` : null;
 
       invoiceBatch.push({
         id: invoiceId, appointmentId: apptId, clientId,
         subtotalCents: effectivePrice, taxCents, tipCents, totalCents,
         status: "paid" as const,
         paymentMethod: pick(["cash", "card", "card", "card", "check"]) as "cash" | "card" | "check",
-        paidAt,
-        stripePaymentIntentId: `pi_test_seed_${String(paidInvoiceCounter).padStart(6, "0")}`,
-        notes: null,
+        paidAt, stripePaymentIntentId, notes: null,
       });
       lineItemBatch.push({
         id: uuid(), invoiceId, description: svc.name, quantity: 1,

packages/types/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@groombook/types",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": {
+      "default": "./dist/index.js",
+      "types": "./src/index.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.3"
+  },
+  "license": "AGPL-3.0-only"
+}

packages/types/src/index.ts

@@ -42,23 +42,10 @@ export interface Pet {
   customFields: Record<string, string>;
   photoKey?: string;
   photoUploadedAt?: string;
-  coatType?: string | null;
-  temperamentScore?: number | null;
-  temperamentFlags?: string[];
-  medicalAlerts?: MedicalAlert[];
-  preferredCuts?: string[];
   createdAt: string;
   updatedAt: string;
 }
 
-export type MedicalAlertSeverity = "low" | "medium" | "high";
-
-export interface MedicalAlert {
-  type: string;
-  description: string;
-  severity: MedicalAlertSeverity;
-}
-
 export interface GroomingVisitLog {
   id: string;
   petId: string;

packages/types/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "skipLibCheck": true,
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src"]
+}

pnpm-workspace.yaml

@@ -1,2 +1,2 @@
 packages:
-  - "apps/*"
+  - "packages/*"

renovate.json

@@ -1,10 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", ":pinAllExceptPeerDependencies", "helpers:pinGitHubActionDigests"],
-  "labels": ["dependencies"],
-  "prConcurrentLimit": 5,
-  "packageRules": [
-    {"matchUpdateTypes": ["minor", "patch"], "groupName": "minor and patch dependencies", "automerge": false},
-    {"matchDepTypes": ["devDependencies"], "matchUpdateTypes": ["minor", "patch"], "automerge": true, "automergeType": "pr"}
-  ]
-}

src/__tests__/auth.test.ts

@@ -5,7 +5,7 @@ let dbSelectResult: unknown[] = [];
 const mockEq = vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val }));
 const mockDecryptSecret = vi.fn((s: string) => `decrypted:${s}`);
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   const authProviderConfig = new Proxy(
     { _name: "auth_provider_config" },
     {
@@ -40,7 +40,7 @@ vi.mock("../db", () => {
 
 async function reimportAuth() {
   vi.resetModules();
-  vi.doMock("./db", () => ({
+  vi.doMock("@groombook/db", () => ({
     getDb: () => ({
       select: () => ({
         from: () => ({

src/__tests__/authProvider.test.ts

@@ -38,7 +38,7 @@ const mockGroomer: MockStaff = { id: "staff-3", role: "groomer", isSuperUser: fa
 
 // ─── Mock db module ───────────────────────────────────────────────────────────
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   const authProviderConfig = new Proxy(
     { _name: "auth_provider_config" },
     {

src/__tests__/clients.test.ts

@@ -40,7 +40,7 @@ function resetMock() {
   deletedId = null;
 }
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   function makeChainable(data: unknown[]): unknown {
     const arr = [...data];
     const chain = new Proxy(arr, {

src/__tests__/confirmation.test.ts

@@ -39,7 +39,7 @@ function resetMock() {
   lastUpdate = {};
 }
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   const appointments = new Proxy(
     { _name: "appointments" },
     { get: (t, p) => (p === "_name" ? "appointments" : { table: "appointments", column: p }) }

src/__tests__/crypto.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { encryptSecret, decryptSecret } from "../db/index.js";
+import { encryptSecret, decryptSecret } from "@groombook/db";
 
 describe("encryptSecret / decryptSecret", () => {
   const originalEnv = process.env.BETTER_AUTH_SECRET;

src/__tests__/factories.test.ts

@@ -6,7 +6,7 @@ import {
   buildPet,
   buildService,
   buildAppointment,
-} from "../db/factories.js";
+} from "@groombook/db/factories";
 
 describe("resetFactoryCounters", () => {
   it("resets all counters so IDs restart from 1", () => {

src/__tests__/impersonation.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { Hono } from "hono";
 import type { AppEnv, StaffRow } from "../middleware/rbac.js";
-import { buildStaff } from "../db/factories.js";
+import { buildStaff } from "@groombook/db/factories";
 
 // ─── Mock data (built with factories for schema-safe defaults) ────────────────
 
@@ -76,7 +76,7 @@ function makeChainableResult(data: unknown[]): unknown {
   });
 }
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   function makeTable(name: string) {
     return new Proxy(
       { _name: name },

src/__tests__/petPhotos.test.ts

@@ -40,7 +40,7 @@ function resetDb() {
 
 // ─── Module mocks ─────────────────────────────────────────────────────────────
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   const pets = new Proxy(
     { _name: "pets" },
     { get(t, p) { return p === "_name" ? "pets" : {}; } }

src/__tests__/portal.test.ts

@@ -47,7 +47,7 @@ function resetMock() {
   updatedValues = [];
 }
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   function makeChainable(data: unknown[]): unknown {
     const arr = [...data];
     const chain = new Proxy(arr, {

src/__tests__/rbac.test.ts

@@ -46,7 +46,7 @@ const GROOMER: StaffRow = {
 let staffLookupResult: StaffRow | null = null;
 let managerFallbackResult: StaffRow | null = MANAGER;
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   const staff = new Proxy(
     { _name: "staff" },
     {

src/__tests__/search.test.ts

@@ -23,7 +23,7 @@ const PET_ROW = {
 let clientResults: typeof ACTIVE_CLIENT[] = [];
 let petResults: typeof PET_ROW[] = [];
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   // Proxy objects for table/column references — values don't matter for tests
   const tableProxy = (name: string) =>
     new Proxy(

src/__tests__/setup.test.ts

@@ -39,7 +39,7 @@ function clearAuthEnv() {
 
 // ─── Mock db module ───────────────────────────────────────────────────────────
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   const authProviderConfig = new Proxy(
     { _name: "auth_provider_config" },
     {

src/__tests__/waitlist.test.ts

@@ -49,7 +49,7 @@ function resetMock() {
   updatedValues = [];
 }
 
-vi.mock("../db", () => {
+vi.mock("@groombook/db", () => {
   function makeChainable(data: unknown[]): unknown {
     const arr = [...data];
     const chain = new Proxy(arr, {

src/index.ts

@@ -22,7 +22,7 @@ import { searchRouter } from "./routes/search.js";
 import { getObject } from "./lib/s3.js";
 import { calendarRouter } from "./routes/calendar.js";
 import { setupRouter } from "./routes/setup.js";
-import { getDb, businessSettings, eq, staff } from "./db/index.js";
+import { getDb, businessSettings, eq, staff } from "@groombook/db";
 import { authMiddleware } from "./middleware/auth.js";
 import { resolveStaffMiddleware, requireRole, requireRoleOrSuperUser, requireSuperUser } from "./middleware/rbac.js";
 import { devRouter } from "./routes/dev.js";

src/lib/auth.ts

@@ -1,8 +1,8 @@
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { genericOAuth } from "better-auth/plugins";
-import { getDb, authProviderConfig, eq } from "../db/index.js";
-import { decryptSecret } from "../db/index.js";
+import { getDb, authProviderConfig, eq } from "@groombook/db";
+import { decryptSecret } from "@groombook/db";
 import { sendEmail } from "../services/email.js";
 
 const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
@@ -97,9 +97,6 @@ export async function initAuth(): Promise<void> {
           window: 10,
           storage: "memory",
           customRules: {
-            "/sign-in/social": { max: 10, window: 60 },
-            "/sign-in/email": { max: 10, window: 60 },
-            "/sign-up/email": { max: 5, window: 60 },
             "/get-session": false,
           },
         },
@@ -250,9 +247,6 @@ export async function initAuth(): Promise<void> {
         window: 10,
         storage: "memory",
         customRules: {
-          "/sign-in/social": { max: 10, window: 60 },
-          "/sign-in/email": { max: 10, window: 60 },
-          "/sign-up/email": { max: 5, window: 60 },
           "/get-session": false,
         },
       },

src/middleware/portalAudit.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { getDb, impersonationAuditLogs } from "../db/index.js";
+import { getDb, impersonationAuditLogs } from "@groombook/db";
 import type { PortalEnv } from "./portalSession.js";
 
 /**

src/middleware/portalSession.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, impersonationSessions } from "../db/index.js";
+import { and, eq, getDb, impersonationSessions } from "@groombook/db";
 
 export interface PortalEnv {
   Variables: {

src/middleware/rbac.ts

@@ -1,7 +1,7 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff } from "../db/index.js";
+import { and, eq, getDb, sql, staff, staffRoleEnum } from "@groombook/db";
 
-export type StaffRole = "groomer" | "receptionist" | "manager";
+type StaffRole = typeof staffRoleEnum.enumValues[number];
 export type StaffRow = typeof staff.$inferSelect;
 
 export interface AppEnv {
@@ -110,6 +110,27 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
       return;
     }
   }
+
+  // Auto-create staff record for authenticated OAuth users with no existing staff record
+  // This allows new OAuth users to access the app (defaults to receptionist role)
+  if (jwt.email && jwt.name) {
+    const [newStaff] = await db
+      .insert(staff)
+      .values({
+        email: jwt.email,
+        name: jwt.name,
+        userId: jwt.sub,
+        role: "receptionist",
+        active: true,
+      })
+      .returning();
+    if (newStaff) {
+      c.set("staff", newStaff);
+      await next();
+      return;
+    }
+  }
+
   return c.json(
     { error: "Forbidden: no staff record found for authenticated user" },
     403

src/routes/admin/seed.ts

@@ -10,7 +10,7 @@
  */
 
 import { Hono } from "hono";
-import { eq, getDb, staff, clients, pets, services } from "../../db/index.js";
+import { eq, getDb, staff, clients, pets, services } from "@groombook/db";
 
 export const adminSeedRouter = new Hono();
 

src/routes/appointmentGroups.ts

@@ -15,7 +15,7 @@ import {
   pets,
   services,
   staff,
-} from "../db/index.js";
+} from "@groombook/db";
 import type { AppEnv } from "../middleware/rbac.js";
 
 export const appointmentGroupsRouter = new Hono<AppEnv>();

src/routes/appointments.ts

@@ -18,7 +18,7 @@ import {
   reminderLogs,
   services,
   staff,
-} from "../db/index.js";
+} from "@groombook/db";
 import { buildConfirmationEmail, sendEmail } from "../services/email.js";
 import { notifyWaitlistForAppointment } from "../services/waitlistNotify.js";
 import type { AppEnv } from "../middleware/rbac.js";

src/routes/authProvider.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { eq, getDb, authProviderConfig, encryptSecret } from "../db/index.js";
+import { eq, getDb, authProviderConfig, encryptSecret } from "@groombook/db";
 import { requireSuperUser } from "../middleware/rbac.js";
 import { reinitAuth } from "../lib/auth.js";