groombook/api

Fork 0

T

Flea Flicker 1f888ac716

CI / Test (pull_request) Successful in 12s

Details

CI / Lint & Typecheck (pull_request) Successful in 15s

Details

CI / Build & Push Docker Images (pull_request) Successful in 1m16s

Details

security(audit): log owner-bypass reads in GET /pets/:id/profile-summary (GRO-2062)

Adds a defense-in-depth audit row to impersonationAuditLogs when the
staff-side owner-bypass path fires. Mirrors the failure-isolation
pattern in src/middleware/portalAudit.ts: insert failures are logged
and swallowed so a working read can never turn into a 500.

- New writeOwnerBypassAudit helper called only when isOwner === true.
- No DB migration; petId + actorStaffId go inside metadata jsonb.
- resolveImpersonationClientId stays pure (no audit side effects).
- Positive + negative tests + a cross-tenant regression test.
- UAT_PLAYBOOK.md §3.19d: TC-API-3.19d documents the audit assertion.

Parent tracking: GRO-2062 (Paperclip).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-02 04:10:58 +00:00

.gitea/workflows

fix(docker): bake pnpm via npm to remove Corepack runtime downloads (GRO-1981)

2026-06-01 14:02:38 +00:00

.github/workflows

fix(ci): build all service images + upgrade Node 22 + pin packageManager (GRO-1522)

2026-05-22 02:16:49 +00:00

apps/api

fix(pets): customer can view own pet profile summary (GRO-2013) (#135 )

2026-06-01 18:40:25 +00:00

packages

fix(db): re-register 0034/0036 schema changes via idempotent 0039/0040 (GRO-2033)

2026-06-01 19:36:22 +00:00

src

security(audit): log owner-bypass reads in GET /pets/:id/profile-summary (GRO-2062)

2026-06-02 04:10:58 +00:00

.ci-trigger

chore: direct push CI trigger for GRO-1757 (b61d899f) to include in dev image

2026-05-26 00:45:05 +00:00

.dockerignore

Initial extraction: groombook/api from groombook/app monorepo

2026-05-02 21:10:21 +00:00

.editorconfig

Initial extraction: groombook/api from groombook/app monorepo

2026-05-02 21:10:21 +00:00

.env.example

Initial extraction: groombook/api from groombook/app monorepo

2026-05-02 21:10:21 +00:00

.gitignore

Merge dev into gitea/migrate-workflows (allow-unrelated-histories)

2026-05-21 01:24:41 +00:00

Dockerfile

fix(docker): bake pnpm via npm to remove Corepack runtime downloads (GRO-1981)

2026-06-01 14:02:38 +00:00

eslint.config.js

Extract groombook/api from monorepo with CI workflow

2026-05-11 01:26:56 +00:00

package.json

merge: resolve conflicts with dev (keep Node 22 + add Gitea CI images)

2026-05-22 02:58:11 +00:00

pnpm-lock.yaml

fix: add better-auth to pnpm-lock.yaml packages/db specifiers

2026-05-22 13:11:39 +00:00

pnpm-workspace.yaml

fix(docker): add missing pnpm-workspace.yaml COPY in deps and runner stages

2026-05-14 16:50:52 +00:00

README.md

Merge dev into gitea/migrate-workflows (allow-unrelated-histories)

2026-05-21 01:24:41 +00:00

renovate.json

chore: add Renovate config

2026-05-14 17:42:22 +00:00

tsconfig.json

Extract groombook/api from monorepo with CI workflow

2026-05-11 01:26:56 +00:00

UAT_PLAYBOOK.md

security(audit): log owner-bypass reads in GET /pets/:id/profile-summary (GRO-2062)

2026-06-02 04:10:58 +00:00

vitest.config.ts

fix: correct vitest alias paths for workspace packages

2026-05-11 01:34:12 +00:00

README.md

GroomBook API

GroomBook API service — extracted from the groombook/app monorepo.

Overview

This repository contains the GroomBook API service, including:

REST API endpoints
Database schema and migrations (via Drizzle ORM)
Authentication (via Better Auth)
Background job handlers

Structure

src/             # API service source
packages/db/     # Database schema, migrations, and utilities
packages/types/  # Shared TypeScript types

Setup

pnpm install
cp .env.example .env  # Fill in required environment variables
pnpm --filter @groombook/api dev

Docker

docker build -t ghcr.io/groombook/api:latest .
docker run -p 3000:3000 ghcr.io/groombook/api:latest

License

AGPL-3.0-only