5f01df819e833c1aa12341fd981f78556acd83ac
The PATCH handler returned the full businessSettings row via .returning(), echoing the encrypted googleMapsApiKey ciphertext back to the caller. Wrap the return in the existing redactSettings() helper (after a !updated guard) so redaction is applied symmetrically with the GET projection (GRO-2294). - src/routes/settings.ts: guard + redactSettings(updated) on PATCH return - src/__tests__/settings.test.ts: assert PATCH omits googleMapsApiKey (existing-row and auto-create-then-update branches) - UAT_PLAYBOOK.md §13 TC-API-13.2: assert PATCH response omits the secret Co-Authored-By: Paperclip <noreply@paperclip.ing>
GRO-2294: Route Optimization security hardening (geocode-batch limit cap + redact settings secret) (#193)
GRO-2294: Route Optimization security hardening (geocode-batch limit cap + redact settings secret) (#193)
GroomBook API
GroomBook API service — extracted from the groombook/app monorepo.
Overview
This repository contains the GroomBook API service, including:
- REST API endpoints
- Database schema and migrations (via Drizzle ORM)
- Authentication (via Better Auth)
- Background job handlers
Structure
src/ # API service source
packages/db/ # Database schema, migrations, and utilities
packages/types/ # Shared TypeScript types
Setup
pnpm install
cp .env.example .env # Fill in required environment variables
pnpm --filter @groombook/api dev
Docker
docker build -t ghcr.io/groombook/api:latest .
docker run -p 3000:3000 ghcr.io/groombook/api:latest
License
AGPL-3.0-only
Description
Languages
TypeScript
99.3%
JavaScript
0.4%
Dockerfile
0.2%