groombook/api
13
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(GRO-1272): auto-provision staff record on first OIDC login #18

Closed
groombook-engineer[bot] wants to merge 1 commits from fleaflicker/gro-1272-v2 into main
pull from: fleaflicker/gro-1272-v2
merge into: groombook:main
Conversation 1 Commits 1 Files Changed 1
+25 -1

1 Commits

Author SHA1 Message Date
Chris Farhood 30268c9df7 fix(GRO-1272): auto-provision staff record on first OIDC login 
When a user authenticates via OIDC but has no staff record (userId NULL,
oidcSub mismatch, email mismatch), resolveStaffMiddleware now checks for
a Better-Auth user record by jwt.sub and auto-creates a minimal groomer
staff record on first login.

This fixes the UAT regression where all API routes returned 403 for all
authenticated users after GRO-1207, because seedKnownUsers() sets
oidcSub to Authentik integer PKs or emails rather than the actual Authentik
OIDC sub (a UUID). The auto-provision path bridges the gap for all UAT
personas without requiring seed/Terraform changes.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-05-14 18:59:48 +00:00