fix(GRO-2672): use drizzle-kit migrate in reset.ts to bypass HWM bug #227

Closed

Flea Flicker wants to merge 72 commits from fix/gro-2672-reset-migrate-hwm into dev

pull from: fix/gro-2672-reset-migrate-hwm

merge into: groombook:dev

groombook:main

groombook:promote/uat-to-main-gro-2745

groombook:uat

groombook:dev

groombook:flea/gro-2721-schema-safe-reset

groombook:fix/gro-2692-readyz-auth-bypass

groombook:fix/gro-2687-readyz-auth-bypass

groombook:revert/gro-2689-health-ready

groombook:fix/remove-gro2689-from-uat

groombook:dev-to-uat-gro-2689

groombook:fix/gro-2672-drizzle-kit-migrate

groombook:fix/GRO-2652-auth-promise-reset

groombook:fix/GRO-2652-ci-yml-corruption

groombook:feature/GRO-2652-boot-econnreset-resilience

groombook:promote/uat-to-main-gro-2586

groombook:promote/GRO-2586-cors-to-uat

groombook:feature/GRO-2586-cors-origin-reflection

groombook:frozen/gro-2425-uat-to-main

groombook:feature/GRO-2425-comma-split-cors-origin

groombook:gro-2381-agents-contributing

groombook:flea/uat-to-main-gro-2359-api

groombook:release/main-GRO-2342-api

groombook:release/main-GRO-2319-api

groombook:flea/promote-main-gro-2311

groombook:promote/GRO-2319-api-to-uat

groombook:feat/GRO-2319-portal-waitlist-surfacing

groombook:flea/promote-main-gro-2172

groombook:dev-to-uat-gro-2311

groombook:flea/gro-2311-seed-portal-statusbadge-appts

groombook:promote/gro-2172-pets-to-uat

groombook:fix/gro-2172-pet-extended-fields

groombook:uat-to-main-gro-2299

groombook:flea/promote-main-gro-2294

groombook:promote/dev-to-uat-gro-2299

groombook:gro-2299-redact-patch-settings

groombook:flea/promote-gro-2294-uat

groombook:flea/gro-2294-route-opt-hardening

groombook:flea/uat-to-main-gro-2157-frozen

groombook:promote/dev-to-uat-gro-2225

groombook:flea/gro-2157-navigation-export

groombook:flea/gro-2235-waitlist-duplicate-409

groombook:feat/gro-2225-uat-seed-route-cohort

groombook:flea/uat-to-main-gro-2234-api

groombook:flea/dev-to-uat-gro-2156

groombook:flea-flicker/gro-2234-portal-session-sliding-ttl

groombook:release/main-6120b96

groombook:flea/gro-2156-travel-buffer-reorder

groombook:release/main-eb92f99

groombook:fix/gro-2214-portal-waitlist-validation

groombook:fix/gro-2203-portal-pet-patch-uuid-validation

groombook:dev-to-uat-gro-2155

groombook:feat/gro-2155-route-optimize-endpoints-dev

groombook:fix/gro-2163-migrate-pre-dns-wait

groombook:fix/gro-2187-portal-photokey-hijack

groombook:dev-to-uat-gro-2154

groombook:feat/gro-2154-geocoding-endpoints-dev

groombook:flea-flicker/gro-2197-ci-api-gate

groombook:dev-to-uat-gro-2153

groombook:dev-to-uat-gro-2187

groombook:fix/gro-2187-portal-pets-patch

groombook:dev-to-uat-gro-2129

groombook:flea-flicker/gro-2123-cleanup-stale-seed-duplicate

groombook:dev-to-uat-gro-2123

groombook:flea-flicker/gro-2123-seed-advisory-lock

groombook:promote/dev-to-uat-gro-2100

groombook:flea/gro-2100-uat-groomer-pet-linkage

groombook:flea/gro-2062-owner-bypass-audit

groombook:flea/gro-2052-rbac-betterauth-user-autoprovision

groombook:dogfather/gro-2013-promote-uat

groombook:flea/gro-2013-owner-bypass-deployed-tree

groombook:flea/gro-2033-idempotent-pet-profile-migrations

groombook:fix/gro-2014-profile-summary-error-handling

groombook:flea/gro-2000-uat-password-source-doc

groombook:fix/gro-1999-uat-seed-extra-large

groombook:fix/gro-1983-seed-pnpm-baked

groombook:fix/GRO-1979-coat-type-pet-size-enum-fix

groombook:fleaflicker/GRO-1962-deterministic-testcoopper-rocky

groombook:flea/gro-1977-seed-idempotency

groombook:fix/GRO-1977-seed-credential-idempotency

groombook:promote/dev-to-uat-gro-1971

groombook:fix/gro-1971-coat-type-enum-missing-short

groombook:fix/GRO-1962-uat-seed-pet-medicalalerts

groombook:flea/GRO-1955-fix-uc-undefined-seed

groombook:fix/GRO-1909-migrate-corepack-offline

groombook:fix/GRO-1953-coat-type-short-missing

groombook:fleaflicker/gro-medical-alert-types-behavioral-skin

groombook:fleaflicker/gro-1921-uat-reset-full-seed

groombook:flea/GRO-1945-pets-visitcount-hotfix

groombook:fix/GRO-1935-uat-customer-client-seed

groombook:fix/GRO-1914-seed-typeof

groombook:feature/GRO-1898-extended-pet-profile-seed

groombook:seed/extended-profile-fields-gro-1898

groombook:fix/gro-1889-reset-demo-data-pnpm

groombook:promote/dev-to-uat-gro-1866

groombook:fix/gro-1866-qa-fixes

groombook:fix/gro-1866-sso-bridge

groombook:fix/gro-1850-pet-profile-migration

groombook:promote/dev-to-uat-gro-1790

groombook:flea-flicker/pet-profile-summary

groombook:ff/gro-1765-trigger-ci

groombook:promo/gro-1764-uat

groombook:ci/gro-1757-build

groombook:fix/gro-1757-sso-auto-provision

groombook:fix/gro-1754-uat-ci

groombook:fix/gro-1754-trigger-ci-v2

groombook:fix/gro-1752-factories-v2

groombook:fix/gro-1752-factories-only

groombook:fix/gro-1746-apply-uat-seed-to-root-src

groombook:fix/gro-1752-extended-pet-profile-fields

groombook:promo/gro-1749-uat

groombook:fix/gro-1749-uat-seed-sync

groombook:fix/gro-1743-uat-seed-data

groombook:fix/gro-1480-portal-pets-patch

groombook:fix/gro-1678-econnreset-robustness

groombook:fix/gro-1576-ci-provenance-false

groombook:fix/gro-1575-ci-provenance

groombook:fix/gro-1566-api-health-auth-bypass

groombook:fix/gro-1544-api-health-endpoint

groombook:fix/gro-1533-migration-0031-coat-type

groombook:fix/gro-1533-missing-migration-0032

groombook:fix/gro-1533-missing-migration-journal

groombook:revert/gro-1533-dockerfile-fix

groombook:fix/gro-1533-revert-dockefile-build-change

groombook:flea-flicker/gro-1531-seed-db-filter

groombook:fix/gro-1522-ci-images-node22

groombook:pr-44

groombook:flea-flicker/gro-1509-better-auth-account-not-linked

groombook:flea-flicker/gro-1162-pet-buffer-time

groombook:fix/gro-1461-uat-playbook-auto-provision

groombook:flea-flicker/pet-profile-editor

groombook:fix/gro-1441-remove-duplicate-coat-props

groombook:fix/gro-1390-pets-test-mock-hoisting

groombook:fix/gro-1395-drizzle-orm-root-dep

groombook:gitea/migrate-workflows

groombook:flea-flicker/fix-gro-1370-ts-and-test-errors

groombook:fix/api/add-devdep-drizzle-orm-fix-vitest

groombook:pr-19

groombook:flea-flicker/uat-email-password-seed

groombook:fleaflicker/gro-1272-v2

groombook:fleaflicker/gro-1272-auto-provision-staff

groombook:add-renovate-config

groombook:flea-flicker/gro-1231-pnpm-workspace-dockerfile

groombook:fix/GRO-1202-rate-limit-override

groombook:fix/typescript-errors

groombook:flea-flicker/pet-profile-extended-fields

groombook:fix/uat-tester-oidc-sub

groombook:flea-flicker/fix-authprovider-mock-path

groombook:flea-flicker/auto-create-staff-oauth-users-v2

groombook:flea-flicker/auto-create-staff-oauth-users

groombook:docs/GRO-1099-uat-playbook-api

groombook:flea-flicker/fix-ci-install-deps-v2

groombook:flea-flicker/fix-ci-install-deps

Conversation 0 Commits 72 Files Changed 5

+172 -156

Flea Flicker commented 2026-08-06 08:56:32 +00:00

Member

Copy Link

Copy Source

Root cause

drizzle-orm/postgres-js/migrator's migrate() function has the known high-water-mark (HWM) bug (GRO-1999, GRO-2033). When reset.ts drops the drizzle schema and calls migrate() on a fresh DB, it applies migration 0000 first — setting the HWM to when = 1773771452946 (2026-03-17). Migrations with stale 2025-era when timestamps are silently skipped:

Migration	when	Date	Effect when skipped
0001	1742241600000	2025-03-17	pets.health_alerts missing
0003	1742169600000	2025-03-17	recurring_series table + appointments.series_id/series_index missing
0010	1742500800000	2025-03-20	impersonation_sessions table missing
0011	1742587200000	2025-03-21	impersonation indexes missing

Migration 0003 is the blocker. It creates the recurring_series table and adds series_id/series_index columns to appointments. Since migrate() wraps all SQL in a single Postgres transaction, any downstream applied migration that depends on those objects fails — causing a full rollback that takes migration 0000's staff and services tables with it.

After reset exits 1, the DB has zero tables and no drizzle ledger. The next reset hits the same failure. The standalone seed-test-data K8s Job also fails because tables don't exist.

The K8s migrate-schema-552a4d9 Job uses drizzle-kit migrate (hash-based), finds the (also-missing) ledger empty, and applies all 42 migrations correctly — but reset.ts was not using the same approach.

Fix

Replace migrate() from drizzle-orm/postgres-js/migrator with pnpm exec drizzle-kit migrate (hash-based). drizzle-kit checks each migration's hash against the ledger — it applies every unhashed migration regardless of when timestamp ordering. This matches the K8s migrate Job's behaviour exactly.

One-line diff (conceptually):

-await migrate(db, { migrationsFolder: MIGRATIONS_FOLDER });
+execSync("pnpm exec drizzle-kit migrate", { stdio: "inherit", env: { ...process.env }, cwd: resolve(__dirname, "..") });

drizzle-kit reads packages/db/drizzle.config.ts (schema, migrations folder, DATABASE_URL) from the cwd. pnpm is already in PATH in the Docker reset image (the CMD is pnpm --filter @groombook/db reset).

Recovery path

Once this fix ships to prod (via the standard dev→uat→main pipeline), the next reset-demo-data CronJob run will apply all 42 migrations on a fresh DB (hash-based, no HWM skip) and re-seed successfully.

The K8s migrate Job (migrate-schema-<sha>) will also run on the next Flux reconcile and restore the ledger, but since reset.ts is now correct, the hourly reset will self-heal regardless.

Test plan

• CI passes (lint, typecheck, build)
• UAT: reset-demo-data CronJob runs clean at next :45 mark — verify via pod logs that all 42 migrations are applied and seed completes (Shedward)
• UAT: seed-test-data job completes successfully after reset

cc @cpfarhood

## Root cause `drizzle-orm/postgres-js/migrator`'s `migrate()` function has the known high-water-mark (HWM) bug (GRO-1999, GRO-2033). When `reset.ts` drops the drizzle schema and calls `migrate()` on a fresh DB, it applies migration 0000 first — setting the HWM to `when = 1773771452946` (2026-03-17). Migrations with stale 2025-era `when` timestamps are silently skipped: | Migration | `when` | Date | Effect when skipped | |-----------|--------|------|---------------------| | 0001 | 1742241600000 | 2025-03-17 | `pets.health_alerts` missing | | **0003** | 1742169600000 | 2025-03-17 | **`recurring_series` table + `appointments.series_id`/`series_index` missing** | | 0010 | 1742500800000 | 2025-03-20 | `impersonation_sessions` table missing | | 0011 | 1742587200000 | 2025-03-21 | impersonation indexes missing | **Migration 0003 is the blocker.** It creates the `recurring_series` table and adds `series_id`/`series_index` columns to `appointments`. Since `migrate()` wraps all SQL in a **single Postgres transaction**, any downstream applied migration that depends on those objects fails — causing a full rollback that takes migration 0000's `staff` and `services` tables with it. After reset exits 1, the DB has zero tables and no drizzle ledger. The next reset hits the same failure. The standalone `seed-test-data` K8s Job also fails because tables don't exist. The K8s `migrate-schema-552a4d9` Job uses `drizzle-kit migrate` (hash-based), finds the (also-missing) ledger empty, and applies all 42 migrations correctly — but `reset.ts` was not using the same approach. ## Fix Replace `migrate()` from `drizzle-orm/postgres-js/migrator` with `pnpm exec drizzle-kit migrate` (hash-based). drizzle-kit checks each migration's hash against the ledger — it applies every unhashed migration regardless of `when` timestamp ordering. This matches the K8s migrate Job's behaviour exactly. **One-line diff (conceptually):** ```diff -await migrate(db, { migrationsFolder: MIGRATIONS_FOLDER }); +execSync("pnpm exec drizzle-kit migrate", { stdio: "inherit", env: { ...process.env }, cwd: resolve(__dirname, "..") }); ``` drizzle-kit reads `packages/db/drizzle.config.ts` (schema, migrations folder, DATABASE_URL) from the `cwd`. pnpm is already in PATH in the Docker reset image (the CMD is `pnpm --filter @groombook/db reset`). ## Recovery path Once this fix ships to prod (via the standard dev→uat→main pipeline), the next `reset-demo-data` CronJob run will apply all 42 migrations on a fresh DB (hash-based, no HWM skip) and re-seed successfully. The K8s migrate Job (`migrate-schema-<sha>`) will also run on the next Flux reconcile and restore the ledger, but since reset.ts is now correct, the hourly reset will self-heal regardless. ## Test plan - [ ] CI passes (lint, typecheck, build) - [ ] UAT: `reset-demo-data` CronJob runs clean at next :45 mark — verify via pod logs that all 42 migrations are applied and seed completes (Shedward) - [ ] UAT: `seed-test-data` job completes successfully after reset cc @cpfarhood

Flea Flicker added 72 commits 2026-08-06 08:56:33 +00:00

Merge pull request 'chore: migrate .github/workflows to .gitea/workflows' (#22) from gitea/migrate-workflows into main ... e01c12a316

chore: migrate .github/workflows to .gitea/workflows

Migrate CI workflow from GitHub Actions to Gitea Actions.
- Registry: ghcr.io → git.farh.net
- Auth: secrets.GITHUB_TOKEN → gitea.token
- Cache: type=gha → type=registry

Part of GRO-1315.

Merge pull request 'promote: uat → main (GRO-1509 OIDC accountLinking fix)' (#46) from uat into main ... 081379c189

Merge uat → main: GRO-1509 OIDC accountLinking fix

Sign-offs cleared:
- QA: GRO-1510 ✓
- UAT: GRO-1515 ✓
- Security: GRO-1516 ✓
- Infra: groombook/infra PR #413 ✓

Add .mcp.json 185fce8e17

chore: trigger CI from uat for GRO-1754 dd83f29736

Merge pull request 'chore: trigger CI from uat for GRO-1754' (#81) from fix/gro-1754-uat-ci into main ba95088653

Merge pull request 'promote(dev→main): GRO-1752 schema fix for UAT (CI trigger)' (#82) from dev into main c8bbb12edb

fix(ci): remove duplicate provenance keys causing YAML parse error ... 152abfc4d5

Duplicate 'provenance: false' in each docker/build-push-action step caused
Gitea to reject the workflow file, breaking push CI and workflow_dispatch.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'promote: uat → main (GRO-1757 SSO auto-provision fix)' (#89) from uat into main 403634eb96

Merge pull request 'Promote dev→uat: GRO-1982 pet_size_category extra_large enum migration' (#126) from dev into uat ... 8af5a49d14

Promote dev→uat: GRO-1983 seed-job pnpm fix + GRO-1982 extra_large enum migration

Carries the accumulated dev state into uat (PR #125 docker pnpm fix + 0037 migration).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'promote(db): register extra_large via migration 0038 to UAT (GRO-2004)' (#131) from dev into uat f7f88156e1

Merge pull request 'promote(docker): bake pnpm via npm to remove Corepack runtime downloads (GRO-1981)' (#133) from dev into uat ... 5a4b9a98bd

Promote GRO-1985 (parent GRO-1981) dev->uat. cc @cpfarhood

Merge pull request 'Promote dev → uat: UAT seed-password source-of-truth playbook (GRO-2000)' (#134) from dev into uat 6a81a52a50

Merge pull request 'promote: uat → main — pnpm-offline Docker hardening + accumulated UAT fixes (GRO-1985)' (#136) from uat into main ... 766728865e

promote: uat → main — pnpm-offline Docker hardening + accumulated UAT fixes (GRO-1985)

UAT PASS: GRO-2015
Security PASS: GRO-2024 (Barkley Trimsworth)
UAT CI: run #2313 — 3/3 jobs green (incl. offline pnpm smoke tests)

promote(uat): GRO-2014 profile-summary error-handling fix (dev→uat) (#138) 23484dc90a

promote(uat): GRO-2013 owner-bypass + GRO-2033 idempotent migrations (dev→uat) ... 16c959434b

Merge dev into uat. Resolves test-file/playbook conflicts created by PR #138's
squash merge by taking dev's superset versions (verified: all GRO-2014 tests +
TC ids preserved, plus GRO-2013 additions). No-ff merge so dev becomes an
ancestor of uat, preventing future squash-divergence conflicts.

Carries:
- GRO-2013 deployed-tree owner-bypass (src/routes/pets.ts, reconciled 20-test file)
- GRO-2033 idempotent migrations 0039/0040

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'promote(uat): GRO-2013 owner-bypass + GRO-2033 idempotent migrations (dev→uat)' (#142) from dogfather/gro-2013-promote-uat into uat 4e9c4c5e08

Merge pull request 'Promote dev→uat: rbac Better-Auth auto-provision (GRO-2052)' (#144) from dev into uat ... 7181d41b24

Promote dev→uat: rbac Better-Auth auto-provision (GRO-2052)

Makes the pets.ts owner-bypass reachable for Better-Auth email/password customers by auto-provisioning a groomer staff row keyed on user.id. Unblocks GRO-2050 and GRO-2035.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Merge pull request 'promote(main): GRO-2033 prod migration fix + GRO-2013/2014 + rbac auto-provision (uat→main)' (#145) from uat into main ... 2a6242d3de

promote(main): GRO-2033 prod migration fix + GRO-2013/2014 + rbac auto-provision (uat→main)

CI green. UAT regression GRO-2035 PASS. Migrations 0039/0040 idempotent — signed off by CEO.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

promote(dev→uat): owner-bypass read audit row (GRO-2063) (#147) ... bf97849324

Promote GRO-2063 defense-in-depth audit row to uat. CI green. QA + CTO approved on dev PR #146.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'Promote dev→uat: GRO-2033 services_pkey seed fix (fc6c6ef7)' (#149) from dev into uat 411c42b2c4

promote(uat→main): owner-bypass audit fix (GRO-2062) + services seed-idempotency fix (GRO-2064) c92fb2539d

docs(UAT_PLAYBOOK): add TC-UAT-2/3 for uat-groomer linked/unlinked pet profile-summary (GRO-2100) ... bd384bdf5c

Lint Roller review on PR #152 flagged that the GRO-2100 seed change produces
new observable UAT API behavior that the playbook must reflect. Add two
deterministic rows pinning the contract GRO-1987 TC-UAT-2/3 will exercise:

- TC-UAT-2: uat-groomer + linked pet c0000001-...-002 (UAT Pup Alpha) → 200
- TC-UAT-3: uat-groomer + unlinked pet c0000001-...-003 (UAT Pup Beta) → 403

The 403-vs-404 note in TC-UAT-3 mirrors the verification note in the
GRO-2100 issue body so the QA runner knows where to file if the API
returns 404 (a separate RBAC defect, not against the seed).

ci: retrigger GRO-2100 PR #152 Build & Push Docker Images (Reset image build failed — docker registry flake) d4a4ddce37

Merge pull request 'Promote dev→uat: GRO-2100 uat-groomer ↔ UAT Pup Alpha linkage' (#152) from promote/dev-to-uat-gro-2100 into uat ... f2931d7be2

Merge pull request #152 from groombook/promote/dev-to-uat-gro-2100

Promote dev→uat: GRO-2100 uat-groomer ↔ UAT Pup Alpha linkage

chore(uat): GRO-2100 promote uat-groomer seed-linkage ordering fix to uat (#154) ... e639cc82d1

Co-authored-by: Flea Flicker <flea@groombook.dev>
Co-committed-by: Flea Flicker <flea@groombook.dev>

Merge pull request 'dev → uat: GRO-2123 seed advisory lock' (#156) from dev-to-uat-gro-2123 into uat e2eacbc9fe

Merge pull request 'chore: delete stale apps/api/src/db/seed.ts duplicate (GRO-2129)' (#158) from dev into uat 6538406db2

Merge pull request 'promote(uat→main): GRO-2123 seed advisory lock + GRO-2100 uat-groomer linkage ordering' (#157) from uat into main fc072d51f4

Merge pull request 'dev → uat: GRO-2187 portal pet PATCH + GET enrichment (carries GRO-2152)' (#166) from dev-to-uat-gro-2187 into uat b3db206588

Merge pull request 'dev → uat: GRO-2153 abstracted geocoding service' (#168) from dev-to-uat-gro-2153 into uat 027e012a58

dev → uat: GRO-2154 geocoding endpoints (Phase 1.3) (#171) 8721f0b63c

dev → uat: portal photoKey S3 key-hijack fix (GRO-2187/GRO-2198) (#173) 8cf72d926d

Merge uat → main: portal pet PATCH + photoKey S3 key-hijack fix (GRO-2187) (#174) 6e2e46daf8

dev → uat: GRO-2155 route optimization endpoints (carries GRO-2163) (#176) 587fd4ec95

dev → uat: GRO-2203 portal pet PATCH malformed-petId 500→404 (#178) eb92f99c4a

Merge dev into uat: promote GRO-2156 route travel buffer + reorder (Phase 2.2) ... 6120b96c7c

Resolves UAT_PLAYBOOK.md conflict by unioning uat-only TC-UAT-2/3 (GRO-2100)
with dev's §4.16 update + new §4.17. Code files taken from dev (superset).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge dev into uat: add GRO-2234 portal session sliding TTL + re-mint to dev→uat batch 636fa713e1

Merge pull request 'Promote dev → uat: GRO-2155/2156/2203/2211/2163 + GRO-2234 (cumulative batch)' (#182) from flea/dev-to-uat-gro-2156 into uat 96dbb8c41d

Promote dev→uat: GRO-2225 UAT seed route cohort + receptionist credential 76d9850464

Merge pull request 'promote(uat→main FROZEN @6120b96): + GRO-2156 route buffer/reorder (supersedes #185)' (#186) from release/main-6120b96 into main ... 1ad43ce701

promote(uat→main FROZEN @6120b96): GRO-2214+GRO-2211+GRO-2203+GRO-2155+GRO-2163+GRO-2156

CTO-reviewed, CEO-merged per SDLC Phase 4 governance.
Carries: GRO-2214 waitlist validation, GRO-2211, GRO-2203 pet PATCH, GRO-2155+GRO-2163 route optimization, GRO-2156 route buffer/reorder.
All gates passed: QA, Security, UAT 6/6 PASS.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge remote-tracking branch 'origin/dev' into promote/dev-to-uat-gro-2225 d617c69571

ci: re-trigger checks (transient pnpm/action-setup runner flake) ... 37e42b3104

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'Promote dev→uat: GRO-2225 + GRO-2235 + GRO-2157 (atomic)' (#188) from promote/dev-to-uat-gro-2225 into uat ... 4868f18dfd

Promote dev→uat: GRO-2225 + GRO-2235 + GRO-2157 (atomic)

QA-approved on 37e42b3. CI green (Test, Lint & Typecheck, Build & Push).

Merge pull request 'uat→main (PROD): GRO-2234 portal session fix + validated batch' (#191) from flea/uat-to-main-gro-2234-api into main bfe1a29c08

uat→main (PROD): GRO-2157 nav export + GRO-2225/2235 (frozen @4868f18) (#192) ... e9ad92de01

feat: nav export + conflict guard + UAT seed (GRO-2157, GRO-2225, GRO-2235)

Squash-merges PR #192: uat→main PROD promotion.
Freezes at validated SHA 4868f18 (UAT regression GRO-2261 11/11 PASS).
Bundles: GRO-2157 (nav export), GRO-2225 (UAT seed), GRO-2235 (conflict guard).
CTO-reviewed and approved (review #4542).

Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

Promote GRO-2294 to UAT: Route Optimization security hardening (#194) 2566fb8f20

dev → uat: GRO-2299 redact googleMapsApiKey from PATCH /api/admin/settings (#196) 8cd5a2ef4d

uat→main (PROD): GRO-2294 Route Optimization security hardening (frozen @2566fb8) (#197) ... 2b92c2ab6c

feat(security): GRO-2294 Route Optimization security hardening [squash]

Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

uat → main: GRO-2299 redact googleMapsApiKey from PATCH /api/admin/settings (#198) ... 03f79a3701

GRO-2299: redact googleMapsApiKey from PATCH /api/admin/settings response
Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

dev → uat: GRO-2172 extended pet fields (#200) c4385617c6

dev → uat: GRO-2311 seed portal StatusBadge appointments (#201) (#202) 807ccb455f

uat→main (PROD): GRO-2172 pet extended-field schema fix (frozen @c4385617) ... 4bbb0c9fc5

Promote GRO-2172 from uat to main. Pins src/routes/pets.ts to its exact
content at uat merge commit c4385617 (PR #200), adding the extended pet
profile fields to createPetSchema/updatePetSchema and wiring medicalAlerts
into POST/PATCH /pets:

- temperamentScore: int 1–5
- temperamentFlags: string[] (≤20, each ≤100 chars)
- medicalAlerts: {type,description,severity}[] (≤50)
- preferredCuts: string[] (≤20, each ≤200 chars)
- coatType already present on main; schema now references all 5 fields

Based on main HEAD (03f79a37) so the PR diff is limited to src/routes/pets.ts.
GRO-2311 (uat HEAD 807ccb45) is intentionally excluded.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

uat→main (PROD): GRO-2172 pet extended-field schema fix (frozen @c4385617) (#203) ... a9db0ca9ac

Phase-4 promotion. CTO-approved, CI 3/3 green. Single-file diff (src/routes/pets.ts +26/-2), frozen @c4385617. GRO-2311 excluded.

feat(GRO-2319): dev→uat — portal waitlist surfacing + seed (api) (#205) 18640908ed

uat→main (PROD): GRO-2311 seed portal StatusBadge appointments (frozen @df5e768) (#206) ... 31404befee

uat→main (PROD): GRO-2311 seed portal StatusBadge appointments (squash)

Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

Promote uat → main (PROD): GRO-2319 portal waitlist surfacing + seed (#207) ... 47e2021cf4

Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

Promote dev → uat: GRO-2342 portal waitlist service {id, name} ... e932050b45

Resolves conflicts in UAT_PLAYBOOK.md, src/routes/portal.ts, and
src/__tests__/portal.test.ts (dev side wins — GRO-2342 changes are
the only diff in scope). Carries forward GRO-2139 reset.ts advisory
lock + GRO-2294 infra mcp trigger that were merged to dev but not
yet promoted to uat.

- src/routes/portal.ts: GET /portal/appointments now populates
  service: {id, name} on both the synthetic waitlist card and the
  appointment card (was {id} only). Same shape, no portal change
  required.
- src/__tests__/portal.test.ts: services mock + TC-API-8.20 GRO-2342
  assertions on the synthetic waitlist card service name.
- UAT_PLAYBOOK.md: TC-API-8.20 (GRO-2342) appended; TC-API-8.19
  (GRO-2319) retained verbatim.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'Promote dev → uat: GRO-2342 portal waitlist service {id, name}' (#209) from promote/dev-to-uat-gro-2342 into uat 4cc51b32d3

uat→main (PROD): GRO-2342 portal waitlist service {id, name} (frozen @47e2021 + cherry-pick c737bfe) (#211) ... 58305d7a89

Merge pull request 'GRO-2342: portal/appointments — symmetric service {id, name} on both card paths' (#211) from release/main-GRO-2342-api into main

GRO-2342: GET /portal/appointments populates service: {id, name} on the synthetic waitlist card (was {id} only) and on the appointment card (consistent shape). TC-API-8.20 in UAT_PLAYBOOK.md.

Approved CTO. Squashed from release/main-GRO-2342-api @ c737bfe.

Refs: GRO-2342, GRO-2344, GRO-2345, GRO-2346, PR #211.
Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

feat(GRO-2359): add POST /api/portal/clients-from-auth for OOBE (web) ... 5363e1d5dc

The OOBE flow on the web portal calls this endpoint to create a fresh
`clients` row bound to the Better Auth user's email when the SSO
bridge returns 404. Returns 201 on success, 409 if a client with that
email already exists (portal-selection case), 401/503 on auth issues,
400 on invalid body.

The OOBE success path navigates the user back to `/` and lets the
existing `session-from-auth` re-bridge; the new client is now
resolvable by email, so the bridge mints a real portal session.

Tests cover: 401 (no session), 400 (zod), 201 + persisted values
(name trimmed, optional fields normalized to null), 409 (existing
client or unique-constraint race), 503 (auth not configured).

Paired with the web PR on `feature/2357-p2-sso-to-oobe-routing`.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
(cherry picked from commit cdeebec021)

Merge pull request 'Promote dev → uat: GRO-2359 clients-from-auth endpoint' (#213) from promote/GRO-2359-dev-to-uat into uat ... a629331a04

Promote dev → uat: GRO-2359 clients-from-auth endpoint (#213)

Promote uat → main (PROD): GRO-2359 OOBE portal-creation routing (api) (#214) ... bedeb05a67

GRO-2359: add POST /api/portal/clients-from-auth for OOBE (#214)
Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

docs: add AGENTS.md and CONTRIBUTING.md (GRO-2381) (#215) ... ed51a59c80

Co-authored-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>
Co-committed-by: Flea Flicker <22+gb_flea@noreply.git.farh.net>

chore: promote dev → uat (GRO-2425 comma-split CORS_ORIGIN) (#217) ... 63d7aaa8c2

chore: promote dev → uat (GRO-2425 comma-split CORS_ORIGIN)

Co-authored-by: Flea Flicker <flea@groombook.dev>
Co-committed-by: Flea Flicker <flea@groombook.dev>

uat→main (PROD): GRO-2425 comma-split CORS_ORIGIN (frozen @63d7aaa) (#218) ... 1b6cd5825a

feat: support comma-split CORS_ORIGIN for multiple trusted auth origins (GRO-2425)

Co-authored-by: Flea Flicker <flea@groombook.dev>
Co-committed-by: Flea Flicker <flea@groombook.dev>

promote(GRO-2586): dev → uat — CORS origin allowlist enforcement (#220) ... 2d4edb6452

promote(GRO-2586): dev → uat — CORS origin allowlist enforcement

uat→main (PROD): GRO-2586 CORS origin allowlist enforcement (frozen @2d4edb6) (#221) ... 98b1171f98

uat→main (PROD): GRO-2586 CORS origin allowlist enforcement (frozen @2d4edb6)

fix(GRO-2652): promote boot ECONNRESET resilience to UAT (dev→uat) ... 1df834c5bc

Merges boot ECONNRESET resilience fix + CORS enforcement + OOBE endpoint to uat. QA approved (Lint Roller) at #223 (comment)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

chore: remove CI-trigger litter and agent tooling artifact ... 81a833e392

Remove trigger-uat-1779751324.txt (empty CI-trigger file) and .mcp.json
(agent tooling config with bearer token) — neither belongs in main.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

merge(uat): integrate main divergence; resolve UAT_PLAYBOOK conflict ... 03bdd7ec4a

Merge origin/main into uat to resolve divergence (main was 27 commits
ahead). Only real conflict: UAT_PLAYBOOK.md — kept uat's §4.19 Boot
Resilience and §4.20 OOBE clients-from-auth test cases; excluded
.mcp.json and trigger-uat-1779751324.txt from merge result (CTO review
5042 — these must not land on main).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'feat: GRO-2652 boot ECONNRESET resilience + CORS enforcement + OOBE endpoint (uat→main)' (#226) from uat into main ... 552a4d9f28

CTO Approved (review 5044). UAT (Shedward) PASS. Security (Barkley) PASS.

fix(GRO-2672): use drizzle-kit migrate in reset.ts to bypass HWM bug ... 30d02dd7c7

drizzle-orm/postgres-js/migrator's migrate() has the known high-water-mark
bug (GRO-1999/2033): on a fresh DB it applies migration 0000 first, setting
the watermark to its `when` timestamp (1773771452946, 2026-03-17). Migrations
0001, 0003, 0010, 0011 all have stale 2025-era `when` values that fall below
this watermark and are silently skipped.

Migration 0003 (recurring_series) is the critical skip: it creates the
`recurring_series` table and adds `series_id`/`series_index` columns to
`appointments`. Since migrate() wraps all SQL in a single Postgres transaction,
any downstream applied migration that depends on those missing objects causes
a full transaction rollback — including migration 0000's staff and services
tables. The result: every reset-demo-data run since the 552a4d9 deploy leaves
the DB with zero tables, causing both reset-demo-data and seed-test-data jobs
to fail on every subsequent run.

Fix: replace migrate() from drizzle-orm with `pnpm exec drizzle-kit migrate`
(hash-based, same as the K8s migrate Job). drizzle-kit applies every unhashed
migration regardless of its `when` timestamp ordering, matching the K8s migrate
Job's behaviour exactly.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Flea Flicker closed this pull request 2026-08-06 08:57:32 +00:00

Some checks are pending

Hide all checks

CI / Lint & Typecheck (pull_request) Failing after 18s

Details

CI / Test (pull_request) Successful in 21s

Details

CI / Build & Push Docker Images (pull_request) Has been skipped

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

wontfix

This will not be worked on

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

ai-review (AI Review) gb_barkley (Barkley Trimsworth) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) gb_flea (Flea Flicker) flux (Flux CD) admin (Gitea Admin) gb_lint (Lint Roller) renovate (Mend Renovate) gb_pawla (Pawla Abdul) gb_scrubs (Scrubs McBarkley) gb_shedward (Shedward Scissorhands) gb_dogfather (The Dogfather)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#227