From d2591e47cd4a76e814f118fdf231c7a63fa53ecc Mon Sep 17 00:00:00 2001
From: Flea Flicker <fleaflicker@groombook.ai>
Date: Fri, 27 Mar 2026 09:39:11 +0000
Subject: [PATCH] =?UTF-8?q?fix(gro-48):=20address=20QA=20review=20feedback?=
 =?UTF-8?q?=20=E2=80=94=20staffRow=3F.role=20and=20portal=20TS=20guards?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- appointments.ts: use staffRow?.role (consistent with clients.ts/pets.ts)
  to handle undefined staff context safely
- portal.ts: add null guards on .returning() results for confirm and cancel
  endpoints (TS18048: 'updated' is possibly undefined)
- All 188 tests passing; TypeScript typecheck clean

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/api/src/routes/appointments.ts | 4 ++--
 apps/api/src/routes/portal.ts       | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/apps/api/src/routes/appointments.ts b/apps/api/src/routes/appointments.ts
index 59723f2..c693325 100644
--- a/apps/api/src/routes/appointments.ts
+++ b/apps/api/src/routes/appointments.ts
@@ -73,7 +73,7 @@ appointmentsRouter.get("/", async (c) => {
   const to = c.req.query("to");
   const staffId = c.req.query("staffId");
   const staffRow = c.get("staff");
-  const isGroomer = staffRow.role === "groomer";
+  const isGroomer = staffRow?.role === "groomer";
 
   const conditions = [];
   if (from) conditions.push(gte(appointments.startTime, new Date(from)));
@@ -108,7 +108,7 @@ appointmentsRouter.get("/", async (c) => {
 appointmentsRouter.get("/:id", async (c) => {
   const db = getDb();
   const staffRow = c.get("staff");
-  const isGroomer = staffRow.role === "groomer";
+  const isGroomer = staffRow?.role === "groomer";
   const [row] = await db
     .select()
     .from(appointments)
diff --git a/apps/api/src/routes/portal.ts b/apps/api/src/routes/portal.ts
index 4d6284f..65960df 100644
--- a/apps/api/src/routes/portal.ts
+++ b/apps/api/src/routes/portal.ts
@@ -134,6 +134,10 @@ portalRouter.post("/appointments/:id/confirm", async (c) => {
     .where(eq(appointments.id, id))
     .returning();
 
+  if (!updated) {
+    return c.json({ error: "Not found" }, 404);
+  }
+
   return c.json({
     id: updated.id,
     confirmationStatus: updated.confirmationStatus,
@@ -194,6 +198,10 @@ portalRouter.post("/appointments/:id/cancel", async (c) => {
     .where(eq(appointments.id, id))
     .returning();
 
+  if (!updated) {
+    return c.json({ error: "Not found" }, 404);
+  }
+
   return c.json({
     id: updated.id,
     status: updated.status,