From 337c0e2733f9ab6462313687621c788a2b79c147 Mon Sep 17 00:00:00 2001 From: Paperclip Date: Mon, 1 Jun 2026 15:30:34 +0000 Subject: [PATCH 1/3] docs(UAT_PLAYBOOK): document canonical source-of-truth for UAT seed passwords (GRO-2000) The 'Source of truth for UAT passwords' subsection under Pre-conditions records: - The seed-uat-passwords Secret in groombook-uat is the live source. - The Bitnami SealedSecret apps/overlays/uat/ss-seed-uat-passwords.yaml in groombook/infra is the single upstream source of truth. - A kubectl recipe to pull the current values for SUPER / GROOMER / TESTER / CUSTOMER at the start of every UAT run. - The 'captured env var from a previous rotation produces 401' failure mode that GRO-2000 hit, and the manual-reseed escape hatch if the login still 401s after pulling the live value. Refs: GRO-2000, GRO-1977 (idempotent re-hash), GRO-1999 (enum fix that allowed the seed Job to run cleanly again). Co-Authored-By: Claude Opus 4.8 --- UAT_PLAYBOOK.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index c5bdf04..f0e1037 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -19,6 +19,27 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet - OIDC authentication provider configured - Seed data present (clients, pets, services, staff) +### Source of truth for UAT passwords (GRO-2000) + +The `UAT_SUPER_PASSWORD` / `UAT_GROOMER_PASSWORD` / `UAT_TESTER_PASSWORD` / `UAT_CUSTOMER_PASSWORD` env vars the test orchestrator uses **must** be pulled from the live `seed-uat-passwords` Secret in the UAT cluster — never from a captured shell value, a previous run's `.env`, or a copy of the SealedSecret committed before the latest rotation. + +**Canonical recipe** (works from any host with `kubectl` + cluster credentials): + +```bash +SUPER=$(kubectl get secret seed-uat-passwords -n groombook-uat \ + -o jsonpath='{.data.super-password}' | base64 -d) +GROOMER=$(kubectl get secret seed-uat-passwords -n groombook-uat \ + -o jsonpath='{.data.groomer-password}' | base64 -d) +TESTER=$(kubectl get secret seed-uat-passwords -n groombook-uat \ + -o jsonpath='{.data.tester-password}' | base64 -d) +CUSTOMER=$(kubectl get secret seed-uat-passwords -n groombook-uat \ + -o jsonpath='{.data.customer-password}' | base64 -d) +``` + +**Why:** the Bitnami SealedSecret `apps/overlays/uat/ss-seed-uat-passwords.yaml` (in `groombook/infra`) is the single source of truth. The UAT `reset-demo-data` CronJob re-hashes these values into the `account` table on every run (idempotent — GRO-1977). A captured env var from a previous generation will not match the current hash, producing 401 `INVALID_EMAIL_OR_PASSWORD`. If the live login still 401s after pulling from the SealedSecret, the seed Job is stale — trigger `kubectl create job --from=cronjob/reset-demo-data -n groombook-uat manual-seed-$$` and retry. + +**How to apply:** at the start of every UAT run that touches TC-API-1.4 / 1.5 / 1.6 / 1.7 / 3.18 / 3.21 / 3.23, refresh these four env vars from the cluster before issuing the sign-in request. + ## Test Cases ### 4.0 Health Check -- 2.52.0 From 7fe578aeeffea3a76fe5ec6af50394d325f782c2 Mon Sep 17 00:00:00 2001 From: Paperclip Date: Mon, 1 Jun 2026 17:42:59 +0000 Subject: [PATCH 2/3] fix(pets): customer can view own pet profile summary (GRO-2013) When a customer (e.g. uat-customer@groombook.dev) signs in via Better Auth and calls GET /api/pets/{ownPetId}/profile-summary with their portal session header, the staff RBAC middleware auto-provisions a 'groomer' staff row for them (rbac.ts) and the profile-summary route's groomerLinkageCheck then denies the request with 403 Forbidden, because the auto-provisioned customer-as-groomer has no appointment linkage. This adds an owner-bypass: when a groomer-role staff row is making the request with a valid X-Impersonation-Session-Id header, and the resolved impersonation session's clientId matches the pet's clientId, we treat the caller as the pet's owner and skip the groomerLinkageCheck. The bypass is intentionally scoped to the profile-summary endpoint and to the existing portal session mechanism (no new roles, no staff-row shape changes). Cross-tenant access is still blocked because the bypass requires session.clientId === pet.clientId. Co-Authored-By: Paperclip --- UAT_PLAYBOOK.md | 3 + .../src/__tests__/petProfileSummary.test.ts | 115 ++++++++++++++++++ apps/api/src/routes/pets.ts | 38 +++++- 3 files changed, 155 insertions(+), 1 deletion(-) diff --git a/UAT_PLAYBOOK.md b/UAT_PLAYBOOK.md index f0e1037..4bb82ed 100644 --- a/UAT_PLAYBOOK.md +++ b/UAT_PLAYBOOK.md @@ -125,6 +125,9 @@ CUSTOMER=$(kubectl get secret seed-uat-passwords -n groombook-uat \ | TC-API-3.17 | Get pet profile summary — groomer restricted | GET /api/pets/{id}/profile-summary as groomer with no pet linkage | 403 Forbidden | | TC-API-3.18 | Get pet profile summary — visitCount returns full count | GET /api/pets/{id}/profile-summary with 2+ completed appointments | visitCount >= 2 (not capped at 1) | | TC-API-3.19 | Get pet profile summary — upcomingAppointment excludes past | GET /api/pets/{id}/profile-summary with a past confirmed/scheduled appointment | upcomingAppointment is null (past appointments filtered by startTime >= now) | +| TC-API-3.19a | Get pet profile summary — customer owner-bypass (GRO-2013) | Sign in as `uat-customer@groombook.dev`; `POST /api/portal/session-from-auth`; then `GET /api/pets/{ownPetId}/profile-summary` with header `X-Impersonation-Session-Id: {sessionId}` for either of the customer's seeded pets (`c0000001-0000-0000-0000-000000000002` UAT Pup Alpha, `c0000001-0000-0000-0000-000000000003` UAT Pup Beta) | 200 OK, aggregated profile returned (owner-bypass: customer with valid portal session for pet's clientId is allowed even though rbac.ts auto-provisions them as a `groomer` staff row with no appointment linkage) | +| TC-API-3.19b | Get pet profile summary — customer cross-tenant blocked (GRO-2013) | Sign in as `uat-customer@groombook.dev`; reuse the customer's sessionId from TC-API-3.19a; `GET /api/pets/{otherClientPetId}/profile-summary` for a pet owned by a different client (`c0000002-...` or any non-customer pet) | 403 Forbidden (owner-bypass requires session.clientId === pet.clientId) | +| TC-API-3.19c | Get pet profile summary — customer without portal session header | Same as TC-API-3.19a but omit the `X-Impersonation-Session-Id` header | 403 Forbidden (no owner-bypass without valid portal session) | #### Seed Data Verification (GRO-1898) diff --git a/apps/api/src/__tests__/petProfileSummary.test.ts b/apps/api/src/__tests__/petProfileSummary.test.ts index f7e5686..91fe3bb 100644 --- a/apps/api/src/__tests__/petProfileSummary.test.ts +++ b/apps/api/src/__tests__/petProfileSummary.test.ts @@ -44,6 +44,7 @@ interface MockState { groomingLogs: Record[]; staffMembers: Record[]; services: Record[]; + impersonationSessions: Record[]; } let mock: MockState; @@ -168,6 +169,19 @@ function resetMock() { { id: "service-1", name: "Full Groom", description: null, basePriceCents: 6000, durationMinutes: 120, active: true, createdAt: new Date(), updatedAt: new Date() }, { id: "service-2", name: "Bath & Brush", description: null, basePriceCents: 4000, durationMinutes: 60, active: true, createdAt: new Date(), updatedAt: new Date() }, ], + impersonationSessions: [ + { + id: "sess-owner", + staffId: "staff-groomer-id", + clientId: CLIENT_ID, + reason: "sso-bridge", + status: "active", + startedAt: new Date("2024-11-01"), + endedAt: null, + expiresAt: new Date("2099-01-01T00:00:00Z"), + createdAt: new Date("2024-11-01"), + }, + ], }; } @@ -177,6 +191,7 @@ vi.mock("../db/index.js", () => { const groomingVisitLogs = new Proxy({ _name: "groomingVisitLogs" }, { get: (t, p) => p === "_name" ? "groomingVisitLogs" : {} }); const staff = new Proxy({ _name: "staff" }, { get: (t, p) => p === "_name" ? "staff" : {} }); const services = new Proxy({ _name: "services" }, { get: (t, p) => p === "_name" ? "services" : {} }); + const impersonationSessions = new Proxy({ _name: "impersonationSessions" }, { get: (t, p) => p === "_name" ? "impersonationSessions" : {} }); // Tracks { [tableName]: { [alias]: SQLExpression } } for the current select() call let selectedColumns: Record> = {}; @@ -248,6 +263,7 @@ vi.mock("../db/index.js", () => { if (name === "groomingVisitLogs") return makeChainable(mock.groomingLogs); if (name === "staff") return makeChainable(mock.staffMembers); if (name === "services") return makeChainable(mock.services); + if (name === "impersonationSessions") return makeChainable(mock.impersonationSessions); return makeChainable([]); }, }; @@ -261,6 +277,7 @@ vi.mock("../db/index.js", () => { groomingVisitLogs, staff, services, + impersonationSessions, and: vi.fn((a: unknown, b: unknown) => [a, b]), desc: vi.fn((c: unknown) => c), eq: vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val })), @@ -399,4 +416,102 @@ describe("GET /:id/profile-summary — empty history", () => { expect(body.recentGroomingHistory).toEqual([]); expect(body.lastVisitDate).toBeNull(); }); +}); + +describe("GET /:id/profile-summary — owner-bypass via X-Impersonation-Session-Id (GRO-2013)", () => { + beforeEach(resetMock); + + // Simulates the rbac.ts auto-provisioned "groomer" that a customer gets on first login: + // role=groomer, no linkage to any appointment. + const CUSTOMER_STAFF: StaffRow = { + id: "staff-customer-id", + oidcSub: null, + userId: "user-customer-id", + role: "groomer", + isSuperUser: false, + name: "UAT Customer", + email: "uat-customer@groombook.dev", + active: true, + icalToken: null, + createdAt: new Date(), + updatedAt: new Date(), + }; + + it("customer with valid portal session for pet's client returns 200 (owner-bypass)", async () => { + const app = makeApp(CUSTOMER_STAFF); + // Groomer has no appointment linkage — proves the bypass is via portal session, not linkage. + mock.appointments = []; + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-owner" }, + }); + expect(res.status).toBe(200); + const body = await res.json(); + expect(body.id).toBe(PET_ID); + expect(body.name).toBe("Biscuit"); + expect(body.clientId).toBe(CLIENT_ID); + }); + + it("customer without X-Impersonation-Session-Id header still gets 403 (no bypass)", async () => { + const app = makeApp(CUSTOMER_STAFF); + mock.appointments = []; + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(403); + }); + + it("customer with portal session for a DIFFERENT client gets 403 (cross-tenant blocked)", async () => { + const app = makeApp(CUSTOMER_STAFF); + mock.appointments = []; + mock.impersonationSessions = [ + { + id: "sess-other-client", + staffId: "staff-customer-id", + clientId: "00000000-0000-0000-0000-000000000099", // different from CLIENT_ID + reason: "sso-bridge", + status: "active", + startedAt: new Date("2024-11-01"), + endedAt: null, + expiresAt: new Date("2099-01-01T00:00:00Z"), + createdAt: new Date("2024-11-01"), + }, + ]; + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-other-client" }, + }); + expect(res.status).toBe(403); + }); + + it("customer with expired portal session still gets 403", async () => { + const app = makeApp(CUSTOMER_STAFF); + mock.appointments = []; + mock.impersonationSessions = [ + { + id: "sess-expired", + staffId: "staff-customer-id", + clientId: CLIENT_ID, + reason: "sso-bridge", + status: "active", + startedAt: new Date("2024-01-01"), + endedAt: null, + expiresAt: new Date("2024-02-01T00:00:00Z"), // expired long ago + createdAt: new Date("2024-01-01"), + }, + ]; + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-expired" }, + }); + expect(res.status).toBe(403); + }); + + it("manager does NOT need the impersonation header (existing role check still works)", async () => { + const app = makeApp(MANAGER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(200); + }); + + it("groomer with linkage to pet's client still works (regression — no regression from bypass)", async () => { + const app = makeApp(GROOMER); + // GROOMER fixture has appointments linked to staff-groomer-id in the mock state + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(200); + }); }); \ No newline at end of file diff --git a/apps/api/src/routes/pets.ts b/apps/api/src/routes/pets.ts index f8b6440..d678f6f 100644 --- a/apps/api/src/routes/pets.ts +++ b/apps/api/src/routes/pets.ts @@ -1,7 +1,7 @@ import { Hono } from "hono"; import { zValidator } from "@hono/zod-validator"; import { z } from "zod/v3"; -import { and, desc, eq, exists, getDb, gte, groomingVisitLogs, or, pets, appointments, staff, services, sql } from "../db/index.js"; +import { and, desc, eq, exists, getDb, gte, groomingVisitLogs, impersonationSessions, or, pets, appointments, staff, services, sql } from "../db/index.js"; import type { AppEnv } from "../middleware/rbac.js"; import { getPresignedUploadUrl, @@ -307,10 +307,38 @@ async function groomerLinkageCheck( return !!linkage; } +/** + * Resolves the clientId from the X-Impersonation-Session-Id header, if present and active. + * Used by staff routes to allow a customer (auto-provisioned as a `groomer` staff row + * by rbac.ts) to access their own pet's data when they are the rightful owner. + * + * Returns null when the header is missing, the session is unknown/expired/ended, or the + * session exists but has no clientId — callers should treat null as "no owner-bypass". + */ +async function resolveImpersonationClientId( + db: ReturnType, + c: { req: { header: (name: string) => string | undefined } } +): Promise { + const sessionId = c.req.header("X-Impersonation-Session-Id"); + if (!sessionId) return null; + const [session] = await db + .select({ clientId: impersonationSessions.clientId, status: impersonationSessions.status, expiresAt: impersonationSessions.expiresAt }) + .from(impersonationSessions) + .where(eq(impersonationSessions.id, sessionId)) + .limit(1); + if (!session) return null; + if (session.status !== "active") return null; + if (session.expiresAt <= new Date()) return null; + return session.clientId; +} + /** * GET /:id/profile-summary * Returns aggregated profile: basic pet fields + grooming history + visit stats + upcoming appointment. * Groomer RBAC: same visibility rules as GET /:id. + * Owner-bypass (GRO-2013): a customer who supplies a valid X-Impersonation-Session-Id + * for the pet's owning client may read their own pet's summary, even though rbac.ts + * auto-provisions them as a `groomer` staff row with no appointment linkage. */ petsRouter.get("/:id/profile-summary", async (c) => { const db = getDb(); @@ -321,7 +349,15 @@ petsRouter.get("/:id/profile-summary", async (c) => { const [row] = await db.select().from(pets).where(eq(pets.id, petId)); if (!row) return c.json({ error: "Not found" }, 404); + // Owner-bypass: customer with a valid portal session for this pet's client + // is allowed to view their own pet's profile summary (GRO-2013). + let isOwner = false; if (isGroomer) { + const ownerClientId = await resolveImpersonationClientId(db, c); + isOwner = !!ownerClientId && ownerClientId === row.clientId; + } + + if (isGroomer && !isOwner) { const hasLinkage = await groomerLinkageCheck(db, row.clientId, staffRow); if (!hasLinkage) return c.json({ error: "Forbidden" }, 403); } -- 2.52.0 From a9ed681726f7d71da3650ef9e1e4ec788a5bf0d4 Mon Sep 17 00:00:00 2001 From: Paperclip Date: Mon, 1 Jun 2026 19:08:28 +0000 Subject: [PATCH 3/3] fix(pets): port owner-bypass into deployed tree (GRO-2013) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix for GRO-2013 (customer cannot view own pet profile summary) landed in apps/api/src/routes/pets.ts, which is dead code in the Docker build path. The Dockerfile does COPY src/ + pnpm build from the repo root, so apps/api/ is never copied into the image and is not a pnpm-workspace member. Port the owner-bypass into the deployed-tree handler src/routes/pets.ts: - Add resolveImpersonationClientId(db, c) helper that reads the X-Impersonation-Session-Id header, validates the session is active and not expired, and returns its clientId (or null). - Gate the existing groomer 403 in GET /:id/profile-summary so an owner (session.clientId === pet.clientId) bypasses the appointment-linkage check. This mirrors the already-reviewed logic from apps/api/src/routes/pets.ts:318-364. - Cross-tenant access remains blocked: the bypass requires session.clientId === pet.clientId, and groomers with no portal session still 403 as before. Tests (src/__tests__/petProfileSummary.test.ts — new file, mirroring the dead-tree test pattern but pointing at the deployed handler): - Customer with valid active session for pet's client → 200 - Customer with no header → 403 - Customer with session for a different client → 403 - Customer with expired session → 403 - Customer with ended (status != active) session → 403 - Customer with unknown session id → 403 - Manager does not need the impersonation header (regression) - Groomer with linkage to pet's client still works (regression) - Customer cannot view another client's pet (cross-tenant block) Full @groombook/api test suite: 560 passed (39 files). Note (out of scope): the apps/api/ duplicate tree is dead code producing false-green coverage — recommend filing a separate tech-debt issue to delete apps/api/ or wire it into the workspace, but not blocking this fix on it. Co-Authored-By: Paperclip --- src/__tests__/petProfileSummary.test.ts | 469 ++++++++++++++++++++++++ src/routes/pets.ts | 42 ++- 2 files changed, 510 insertions(+), 1 deletion(-) create mode 100644 src/__tests__/petProfileSummary.test.ts diff --git a/src/__tests__/petProfileSummary.test.ts b/src/__tests__/petProfileSummary.test.ts new file mode 100644 index 0000000..d3d529f --- /dev/null +++ b/src/__tests__/petProfileSummary.test.ts @@ -0,0 +1,469 @@ +/** + * Pet Profile Summary Tests + * + * Covers GET /api/pets/:id/profile-summary in the deployed tree + * (root src/). The headline cases validate the GRO-2013 owner-bypass: + * a customer who is auto-provisioned as a `groomer` staff row by rbac.ts + * (with no appointment linkage) may still read their own pet's summary + * when they supply a valid X-Impersonation-Session-Id whose clientId + * matches the pet's clientId. + * + * Deployed tree: src/routes/pets.ts. This test mirrors the live handler + * (which queries the `appointments` table for visit history, not + * `groomingVisitLogs`). + */ + +import { describe, it, expect, vi, beforeEach } from "vitest"; +import { Hono } from "hono"; +import type { AppEnv, StaffRow } from "../middleware/rbac.js"; + +// ─── Mock staff fixtures ────────────────────────────────────────────────────── + +const MANAGER: StaffRow = { + id: "staff-manager-id", + oidcSub: "oidc-manager-sub", + userId: null, + role: "manager", + isSuperUser: true, + name: "Manager McManager", + email: "manager@example.com", + active: true, + icalToken: null, + createdAt: new Date(), + updatedAt: new Date(), +}; + +const GROOMER: StaffRow = { + ...MANAGER, + id: "staff-groomer-id", + oidcSub: "oidc-groomer-sub", + role: "groomer", + name: "Groomer Gary", + email: "groomer@example.com", +}; + +/** + * Mirrors the auto-provisioned "groomer" staff row rbac.ts creates for an + * OIDC user (e.g. uat-customer@groombook.dev) on first login: role=groomer, + * no appointment linkage. + */ +const CUSTOMER_STAFF: StaffRow = { + ...MANAGER, + id: "staff-customer-id", + oidcSub: null, + userId: "user-customer-id", + role: "groomer", + name: "UAT Customer", + email: "uat-customer@groombook.dev", +}; + +// ─── Mutable mock state ─────────────────────────────────────────────────────── + +const CLIENT_ID = "c0000001-0000-0000-0000-000000000001"; +const PET_ID = "c0000001-0000-0000-0000-000000000002"; +const OTHER_CLIENT_PET_ID = "c0000002-0000-0000-0000-000000000099"; + +const futureDate = () => new Date(Date.now() + 30 * 60_000); +const pastDate = () => new Date(Date.now() - 5 * 60_000); + +function makePet(overrides: Record = {}) { + return { + id: PET_ID, + clientId: CLIENT_ID, + name: "Biscuit", + species: "dog", + breed: "Golden Retriever", + weightKg: "30.00", + dateOfBirth: null, + healthAlerts: null, + groomingNotes: null, + cutStyle: null, + shampooPreference: null, + specialCareNotes: null, + customFields: {}, + petSizeCategory: "large", + coatType: "double", + photoKey: null, + photoUploadedAt: null, + createdAt: new Date("2024-01-01"), + updatedAt: new Date("2024-01-01"), + ...overrides, + }; +} + +function makeAppointment(overrides: Record = {}) { + return { + id: "appt-1", + clientId: CLIENT_ID, + petId: PET_ID, + serviceId: "service-1", + staffId: GROOMER.id, + batherStaffId: null, + status: "completed", + startTime: new Date("2024-06-01T09:00:00Z"), + endTime: new Date("2024-06-01T11:00:00Z"), + notes: null, + priceCents: 6000, + seriesId: null, + seriesIndex: null, + groupId: null, + confirmationStatus: "confirmed", + confirmedAt: null, + cancelledAt: null, + confirmationToken: null, + customerNotes: null, + createdAt: new Date("2024-05-15"), + updatedAt: new Date("2024-05-15"), + ...overrides, + }; +} + +function makeService(overrides: Record = {}) { + return { + id: "service-1", + name: "Full Groom", + description: null, + basePriceCents: 6000, + durationMinutes: 120, + active: true, + createdAt: new Date(), + updatedAt: new Date(), + ...overrides, + }; +} + +function makeSession(overrides: Record = {}) { + return { + id: "sess-owner", + staffId: CUSTOMER_STAFF.id, + clientId: CLIENT_ID, + reason: "sso-bridge", + status: "active", + startedAt: new Date(), + endedAt: null, + expiresAt: futureDate(), + createdAt: new Date(), + ...overrides, + }; +} + +// ─── DB mock state ──────────────────────────────────────────────────────────── + +let petsTable: Record[]; +let appointmentsTable: Record[]; +let servicesTable: Record[]; +let sessionsTable: Record[]; + +// selectQueue: queries resolve in FIFO order. Each .from(table) result +// returns a chain that resolves to the next queued row set on a terminal +// call (.where()/.orderBy()/.limit()). +let selectQueue: Array<{ table: string; rows: unknown[] }> = []; + +function enqueue(table: string, rows: unknown[] = []) { + selectQueue.push({ table, rows }); +} + +function resetMock() { + petsTable = [makePet()]; + appointmentsTable = [makeAppointment()]; + servicesTable = [makeService()]; + sessionsTable = [makeSession()]; + selectQueue = []; +} + +// ─── Module mocks ───────────────────────────────────────────────────────────── + +vi.mock("@groombook/db", () => { + function makeTable(name: string) { + return new Proxy( + { _name: name }, + { + get(target, prop) { + if (prop === "_name") return name; + if (prop === "$inferSelect") return {}; + return { table: name, column: prop }; + }, + } + ); + } + + function sqlMock(_strings: TemplateStringsArray, ..._params: unknown[]) { + const queryString = _strings[0]; + return { + queryChunks: [queryString], + as: (alias: string) => ({ + queryChunks: [queryString], + fieldAlias: alias, + getSQL() { return this.queryChunks; }, + }), + }; + } + + function takeQueuedRows(tableName: string): unknown[] { + const next = selectQueue.shift(); + if (next && next.table === tableName) return next.rows; + return []; + } + + // Wrap a finalised result in a Proxy that exposes chainable methods + // and the resolved rows. Each call to a chainable method (where/orderBy/ + // limit/...) returns the SAME rows so the route's natural await on the + // chain resolves to the queued data. + function wrapRows(rows: unknown[]): unknown { + return new Proxy(rows, { + get(target, prop: string | symbol) { + if (prop === "where" || prop === "orderBy" || prop === "limit" + || prop === "leftJoin" || prop === "innerJoin" || prop === "from") { + return () => wrapRows(rows); + } + if (prop === "then") { + return (onFulfilled?: (v: unknown) => unknown, onRejected?: (e: unknown) => unknown) => + Promise.resolve(rows).then(onFulfilled, onRejected); + } + if (prop === Symbol.iterator) { + return function* () { for (const v of target) yield v; }; + } + if (prop === Symbol.asyncIterator) { + return async function* () { for (const v of target) yield v; }; + } + // @ts-expect-error proxy access + return target[prop]; + }, + }); + } + + return { + getDb: () => ({ + select: (_cols?: Record) => ({ + from: (table: { _name?: string }) => wrapRows(takeQueuedRows(table._name ?? "")), + }), + insert: () => ({ values: () => ({ returning: () => [{}] }) }), + update: () => ({ set: () => ({ where: () => ({ returning: () => [{}] }) }) }), + delete: () => ({ where: () => ({ returning: () => [{}] }) }), + }), + pets: makeTable("pets"), + appointments: makeTable("appointments"), + staff: makeTable("staff"), + services: makeTable("services"), + impersonationSessions: makeTable("impersonationSessions"), + and: vi.fn((..._args: unknown[]) => ({})), + desc: vi.fn((c: unknown) => c), + eq: vi.fn((_a: unknown, _b: unknown) => ({})), + exists: vi.fn(() => true), + or: vi.fn((..._args: unknown[]) => ({})), + sql: sqlMock, + }; +}); + +vi.mock("../lib/s3.js", () => ({ + getPresignedUploadUrl: vi.fn(), + getPresignedGetUrl: vi.fn(), + deleteObject: vi.fn(), +})); + +// ─── Import after mocks are set up ──────────────────────────────────────────── + +const { petsRouter } = await import("../routes/pets.js"); + +// ─── App builder ────────────────────────────────────────────────────────────── + +function buildApp(staffRow: StaffRow) { + const app = new Hono(); + app.use("*", async (c, next) => { + c.set("jwtPayload", { sub: staffRow.oidcSub ?? staffRow.userId ?? "" }); + c.set("staff", staffRow); + await next(); + }); + app.route("/pets", petsRouter); + return app; +} + +// ─── Reset before each test ─────────────────────────────────────────────────── + +beforeEach(() => { + resetMock(); + vi.clearAllMocks(); +}); + +// ─── Tests ──────────────────────────────────────────────────────────────────── + +describe("GET /:id/profile-summary — basic access", () => { + it("returns 404 when the pet does not exist", async () => { + petsTable = []; + enqueue("pets", []); + const app = buildApp(MANAGER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(404); + }); + + it("returns 200 with aggregated profile for a manager", async () => { + // Query order: pets, recent history, visit count, upcoming + enqueue("pets", petsTable); + enqueue("appointments", appointmentsTable); + enqueue("appointments", [{ count: 1 }]); + enqueue("appointments", []); + + const app = buildApp(MANAGER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(200); + const body = await res.json(); + expect(body.id).toBe(PET_ID); + expect(body.name).toBe("Biscuit"); + expect(body.recentGroomingHistory).toBeInstanceOf(Array); + expect(body.visitCount).toBe(1); + expect(body.upcomingAppointment).toBeNull(); + }); + + it("returns 200 for a groomer with appointment linkage to the pet's client", async () => { + // Query order: pets, linkage check, recent history, visit count, upcoming + enqueue("pets", petsTable); + enqueue("appointments", [{ id: "appt-1" }]); // linkage found + enqueue("appointments", appointmentsTable); // history + enqueue("appointments", [{ count: 1 }]); + enqueue("appointments", []); + + const app = buildApp(GROOMER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(200); + }); + + it("returns 403 for a groomer with no appointment linkage and no bypass header", async () => { + // Query order: pets, linkage check (returns empty → 403) + enqueue("pets", petsTable); + enqueue("appointments", []); // no linkage + + const app = buildApp(GROOMER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(403); + }); +}); + +// ─── GRO-2013 owner-bypass ──────────────────────────────────────────────────── + +describe("GET /:id/profile-summary — owner-bypass (GRO-2013)", () => { + it("customer-as-groomer with valid active session for pet's client returns 200", async () => { + // Query order: pets, session lookup (found, active, future), recent history, + // visit count, upcoming + enqueue("pets", petsTable); + enqueue("impersonationSessions", sessionsTable); // active session found + enqueue("appointments", appointmentsTable); + enqueue("appointments", [{ count: 1 }]); + enqueue("appointments", []); + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-owner" }, + }); + expect(res.status).toBe(200); + const body = await res.json(); + expect(body.id).toBe(PET_ID); + }); + + it("customer-as-groomer with no header still gets 403 (no bypass)", async () => { + // Query order: pets, session lookup (header missing → returns [], 403) + enqueue("pets", petsTable); + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(403); + }); + + it("customer-as-groomer with session for a DIFFERENT client gets 403 (cross-tenant blocked)", async () => { + // Session exists but clientId !== pet.clientId → bypass does not apply + // → falls through to groomer linkage check → no linkage → 403 + enqueue("pets", petsTable); + enqueue("impersonationSessions", [ + makeSession({ + id: "sess-other-client", + clientId: "c0000000-0000-0000-0000-000000000099", // different from CLIENT_ID + }), + ]); + enqueue("appointments", []); // no linkage → 403 + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-other-client" }, + }); + expect(res.status).toBe(403); + }); + + it("customer-as-groomer with expired session still gets 403", async () => { + enqueue("pets", petsTable); + enqueue("impersonationSessions", [ + makeSession({ id: "sess-expired", expiresAt: pastDate() }), + ]); + enqueue("appointments", []); // no linkage → 403 + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-expired" }, + }); + expect(res.status).toBe(403); + }); + + it("customer-as-groomer with ended (status != active) session still gets 403", async () => { + enqueue("pets", petsTable); + enqueue("impersonationSessions", [ + makeSession({ id: "sess-ended", status: "ended" }), + ]); + enqueue("appointments", []); // no linkage → 403 + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-ended" }, + }); + expect(res.status).toBe(403); + }); + + it("customer-as-groomer with unknown session id still gets 403", async () => { + enqueue("pets", petsTable); + enqueue("impersonationSessions", []); // session not found + enqueue("appointments", []); // no linkage → 403 + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-unknown" }, + }); + expect(res.status).toBe(403); + }); + + it("manager does NOT need the impersonation header (existing role check still works)", async () => { + enqueue("pets", petsTable); + enqueue("appointments", appointmentsTable); + enqueue("appointments", [{ count: 1 }]); + enqueue("appointments", []); + + const app = buildApp(MANAGER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(200); + }); + + it("groomer with linkage to pet's client still works (regression — no regression from bypass)", async () => { + enqueue("pets", petsTable); + enqueue("appointments", [{ id: "appt-1" }]); // linkage found + enqueue("appointments", appointmentsTable); + enqueue("appointments", [{ count: 1 }]); + enqueue("appointments", []); + + const app = buildApp(GROOMER); + const res = await app.request(`/pets/${PET_ID}/profile-summary`); + expect(res.status).toBe(200); + }); + + it("owner-bypass: customer cannot view another client's pet (cross-tenant block)", async () => { + // The customer has a valid session for CLIENT_ID, but the pet belongs + // to a different client → isOwner=false → falls through to groomer + // linkage check → 403. + enqueue("pets", [ + makePet({ id: OTHER_CLIENT_PET_ID, clientId: "c0000002-0000-0000-0000-000000000002" }), + ]); + enqueue("impersonationSessions", sessionsTable); // valid session, but for CLIENT_ID + enqueue("appointments", []); // no linkage → 403 + + const app = buildApp(CUSTOMER_STAFF); + const res = await app.request(`/pets/${OTHER_CLIENT_PET_ID}/profile-summary`, { + headers: { "X-Impersonation-Session-Id": "sess-owner" }, + }); + expect(res.status).toBe(403); + }); +}); diff --git a/src/routes/pets.ts b/src/routes/pets.ts index ffe494c..a16582c 100644 --- a/src/routes/pets.ts +++ b/src/routes/pets.ts @@ -7,6 +7,7 @@ import { eq, exists, getDb, + impersonationSessions, or, pets, appointments, @@ -109,6 +110,35 @@ petsRouter.get("/:id", async (c) => { return c.json(row); }); +/** + * Resolves the clientId from the X-Impersonation-Session-Id header, if present and active. + * Used by staff routes to allow a customer (auto-provisioned as a `groomer` staff row + * by rbac.ts) to access their own pet's data when they are the rightful owner. + * + * Returns null when the header is missing, the session is unknown/expired/ended, or the + * session exists but has no clientId — callers should treat null as "no owner-bypass". + */ +async function resolveImpersonationClientId( + db: ReturnType, + c: { req: { header: (name: string) => string | undefined } } +): Promise { + const sessionId = c.req.header("X-Impersonation-Session-Id"); + if (!sessionId) return null; + const [session] = await db + .select({ + clientId: impersonationSessions.clientId, + status: impersonationSessions.status, + expiresAt: impersonationSessions.expiresAt, + }) + .from(impersonationSessions) + .where(eq(impersonationSessions.id, sessionId)) + .limit(1); + if (!session) return null; + if (session.status !== "active") return null; + if (session.expiresAt <= new Date()) return null; + return session.clientId; +} + petsRouter.get("/:id/profile-summary", async (c) => { const db = getDb(); const petId = c.req.param("id"); @@ -119,8 +149,18 @@ petsRouter.get("/:id/profile-summary", async (c) => { const [pet] = await db.select().from(pets).where(eq(pets.id, petId)); if (!pet) return c.json({ error: "Not found" }, 404); - // Groomer RBAC: check appointment linkage to this pet's client + // Owner-bypass (GRO-2013): a customer who supplies a valid + // X-Impersonation-Session-Id for the pet's owning client may read their + // own pet's summary, even though rbac.ts auto-provisions them as a + // `groomer` staff row with no appointment linkage. + let isOwner = false; if (isGroomer) { + const ownerClientId = await resolveImpersonationClientId(db, c); + isOwner = !!ownerClientId && ownerClientId === pet.clientId; + } + + // Groomer RBAC: check appointment linkage to this pet's client + if (isGroomer && !isOwner) { const [linkage] = await db .select({ id: appointments.id }) .from(appointments) -- 2.52.0