fix(GRO-1757): auto-provision staff for OIDC users + UAT playbook updates #83

2026-05-25T23:37:17Z

Scrubs McBarkley commented

2026-05-25 23:37:17 +00:00

Summary

Auto-provision staff record for OIDC users (authentik/google/github) who have no pre-existing staff record
Staff record created with groomer role, isSuperUser: false (least-privilege default)
Name derived from jwt.name > email prefix > Unknown
Guard: only auto-provision when OIDC account exists in account table
OOBE flow verified: /api/setup routes bypass resolveStaffMiddleware so setup completes before auto-provision fires

Test Plan

New OIDC users auto-provisioned as groomer on first login
Existing staff records resolve correctly (no regression)
UAT_PLAYBOOK.md updated with SSO Login Journey (TC-API-1.17 to 1.21) and OOBE Flow (TC-API-1.22 to 1.26)

cc @cpfarhood

## Summary - Auto-provision staff record for OIDC users (authentik/google/github) who have no pre-existing staff record - Staff record created with groomer role, isSuperUser: false (least-privilege default) - Name derived from jwt.name > email prefix > Unknown - Guard: only auto-provision when OIDC account exists in account table - OOBE flow verified: /api/setup routes bypass resolveStaffMiddleware so setup completes before auto-provision fires ## Test Plan - [x] New OIDC users auto-provisioned as groomer on first login - [x] Existing staff records resolve correctly (no regression) - [x] UAT_PLAYBOOK.md updated with SSO Login Journey (TC-API-1.17 to 1.21) and OOBE Flow (TC-API-1.22 to 1.26) cc @cpfarhood

Scrubs McBarkley added 1 commit 2026-05-25 23:37:18 +00:00

fix(GRO-1757): auto-provision staff for OIDC users + UAT playbook updates 503235df35

- Add OIDC auto-provision step to resolveStaffMiddleware in rbac.ts:
  query account table for OAuth provider (authentik/google/github) linked to jwt.sub,
  if found create groomer staff record with least-privilege defaults
- Guard: only auto-provision if OIDC account exists, never superuser/manager
- Name derived from jwt.name > email prefix > "Unknown"
- Log auto-creation for observability
- Add SSO Login Journey (TC-API-1.17 to 1.21) and OOBE Flow (TC-API-1.22 to 1.26) test cases
  to groombook-api UAT_PLAYBOOK.md §4.1

Updated UAT_PLAYBOOK.md §5.4.1 (SSO Login Journey) and §5.4.2 (OOBE Flow Post-Login)
in groombook-web.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Scrubs McBarkley merged commit b61d899f81 into dev

2026-05-25 23:39:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#83