Merge branch 'main' into fix/gro-655-corepack-only

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/__tests__/clients.test.ts

@@ -27,14 +27,12 @@ const DISABLED_CLIENT = {
 // ─── Queue-based mock DB ──────────────────────────────────────────────────────
 
 let selectRows: Record<string, unknown>[] = [];
-let appointmentRows: Record<string, unknown>[] = [];
 let insertedValues: Record<string, unknown>[] = [];
 let updatedValues: Record<string, unknown>[] = [];
 let deletedId: string | null = null;
 
 function resetMock() {
   selectRows = [];
-  appointmentRows = [];
   insertedValues = [];
   updatedValues = [];
   deletedId = null;
@@ -60,19 +58,10 @@ vi.mock("@groombook/db", () => {
     { get: (t, p) => (p === "_name" ? "clients" : { table: "clients", column: p }) }
   );
 
-  const appointments = new Proxy(
-    { _name: "appointments" },
-    { get: (t, p) => (p === "_name" ? "appointments" : { table: "appointments", column: p }) }
-  );
-
   return {
     getDb: () => ({
       select: () => ({
-        from: (table: unknown) => {
-          const tableName = (table as { _name?: string })._name;
-          const rows = tableName === "appointments" ? appointmentRows : selectRows;
-          return makeChainable(rows);
-        },
+        from: () => makeChainable(selectRows),
       }),
       insert: () => ({
         values: (vals: Record<string, unknown>) => {
@@ -106,10 +95,8 @@ vi.mock("@groombook/db", () => {
       }),
     }),
     clients,
-    appointments,
     eq: vi.fn(),
     and: vi.fn(),
-    or: vi.fn(),
   };
 });
 

apps/api/src/__tests__/confirmation.test.ts

@@ -68,7 +68,6 @@ vi.mock("@groombook/db", () => {
     }),
     appointments,
     eq: () => ({}),
-    and: (..._clauses: unknown[]) => ({}),
   };
 });
 

apps/api/src/__tests__/rbac.test.ts

@@ -78,7 +78,6 @@ vi.mock("@groombook/db", () => {
     }),
     staff,
     eq: vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val })),
-    and: vi.fn((..._clauses: unknown[]) => ({})),
   };
 });
 
@@ -363,7 +362,7 @@ describe("requireRoleOrSuperUser", () => {
     const res = await app.request("/test");
     expect(res.status).toBe(403);
     const body = await res.json();
-    expect(body.error).toMatch(/role.*not permitted/i);
+    expect(body.error).toMatch(/super user privileges required/i);
   });
 
   it("blocks a non-super-user groomer from manager-only routes", async () => {
@@ -371,7 +370,7 @@ describe("requireRoleOrSuperUser", () => {
     const res = await app.request("/test");
     expect(res.status).toBe(403);
     const body = await res.json();
-    expect(body.error).toMatch(/role.*not permitted/i);
+    expect(body.error).toMatch(/super user privileges required/i);
   });
 
   it("allows a manager with multiple allowed roles", async () => {

apps/api/src/index.ts

@@ -33,26 +33,11 @@ import { webhooksRouter } from "./routes/stripe-webhooks.js";
 const app = new Hono();
 
 // Global middleware
-const TRUSTED_ORIGINS = (process.env.CORS_ORIGIN ?? "http://localhost:5173")
-  .split(",")
-  .map((o) => o.trim());
-
-const ALLOWED_ORIGIN = process.env.CORS_ORIGIN ?? "http://localhost:5173";
-
 app.use("*", logger());
 app.use(
   "/api/*",
   cors({
-    origin: (origin, ctx) => {
-      if (!origin) {
-        return ALLOWED_ORIGIN;
-      }
-      if (TRUSTED_ORIGINS.includes(origin)) {
-        return origin;
-      }
-      ctx.status(403);
-      return null;
-    },
+    origin: process.env.CORS_ORIGIN ?? "http://localhost:5173",
     credentials: true,
   })
 );

apps/api/src/lib/auth.ts

@@ -89,7 +89,7 @@ export async function initAuth(): Promise<void> {
       console.warn("[auth] AUTH_DISABLED=true — building placeholder auth instance");
       authInstance = betterAuth({
         database: drizzleAdapter(getDb(), { provider: "pg" }),
-        secret: BETTER_AUTH_SECRET!,
+        secret: BETTER_AUTH_SECRET ?? "placeholder-secret-do-not-use-in-prod",
         baseURL: BETTER_AUTH_URL,
         rateLimit: {
           enabled: true,
@@ -177,9 +177,9 @@ export async function initAuth(): Promise<void> {
     const hasGoogle = !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
     const hasGitHub = !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET);
 
-    const issuerUrlObj = new URL(providerConfig.issuerUrl);
-    const issuerHostname = issuerUrlObj.hostname;
-
+    // Fetch OIDC discovery document to derive canonical provider URLs.
+    // Replace the host of token/userinfo endpoints with internalBaseUrl when set,
+    // while keeping authorizationUrl public for browser redirects.
     const discoveryUrlStr = `${providerConfig.issuerUrl}/.well-known/openid-configuration`;
     let oidcConfig: Record<string, string> = {};
     try {
@@ -203,18 +203,6 @@ export async function initAuth(): Promise<void> {
         const tokenUrl = discovery.token_endpoint;
         const userInfoUrl = discovery.userinfo_endpoint;
         if (authzUrl && tokenUrl && userInfoUrl) {
-          const authzUrlObj = new URL(authzUrl);
-          const tokenUrlObj = new URL(tokenUrl);
-          const userInfoUrlObj = new URL(userInfoUrl);
-          if (
-            authzUrlObj.hostname !== issuerHostname ||
-            tokenUrlObj.hostname !== issuerHostname ||
-            userInfoUrlObj.hostname !== issuerHostname
-          ) {
-            throw new Error(
-              `[FATAL] OIDC discovery URL hostname mismatch: expected '${issuerHostname}' but got '${authzUrlObj.hostname}', '${tokenUrlObj.hostname}', or '${userInfoUrlObj.hostname}'. This may indicate a man-in-the-middle attack.`
-            );
-          }
           oidcConfig = {
             authorizationUrl: authzUrl,
             tokenUrl: providerConfig.internalBaseUrl

apps/api/src/middleware/portalAudit.ts

@@ -1,45 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import { getDb, impersonationAuditLogs } from "@groombook/db";
-import type { PortalEnv } from "./portalSession.js";
-
-/**
- * Server-side audit logging middleware for portal routes.
- * Applied after validatePortalSession in the middleware chain.
- *
- * After the route handler completes (await next()), inserts an audit log entry
- * into impersonationAuditLogs:
- *   - sessionId: from c.get("portalSessionId")
- *   - action: "{METHOD} {routePath}" (e.g., "GET /portal/appointments")
- *   - pageVisited: c.req.path
- *   - metadata: { method, statusCode: c.res.status }
- *
- * Log entries are written for both success and error responses.
- * Does NOT throw if audit logging fails — errors are logged but the user's
- * request is not affected.
- */
-export const portalAudit: MiddlewareHandler<PortalEnv> = async (c, next) => {
-  await next();
-
-  const sessionId = c.get("portalSessionId");
-  if (!sessionId) return;
-
-  const method = c.req.method;
-  const routePath = c.req.path;
-  const pageVisited = c.req.path;
-  const statusCode = c.res.status;
-
-  try {
-    const db = getDb();
-    await db
-      .insert(impersonationAuditLogs)
-      .values({
-        sessionId,
-        action: `${method} ${routePath}`,
-        pageVisited,
-        metadata: { method, statusCode },
-      })
-      .returning();
-  } catch (err) {
-    console.error("[portalAudit] Failed to write audit log:", err);
-  }
-};

apps/api/src/middleware/portalSession.ts

@@ -1,40 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, impersonationSessions } from "@groombook/db";
-
-export interface PortalEnv {
-  Variables: {
-    portalClientId: string;
-    portalSessionId: string;
-  };
-}
-
-/**
- * Validates the X-Impersonation-Session-Id header against the impersonationSessions table.
- * Must be applied to all portal routes.
- *
- * Reads x-session-id from request headers, queries impersonationSessions for a row where
- * id = sessionId AND status = 'active', and checks session.expiresAt > new Date().
- * Returns 401 if session is invalid/missing/expired.
- * On success, sets c.set("portalClientId", session.clientId) and c.set("portalSessionId", session.id).
- */
-export const validatePortalSession: MiddlewareHandler<PortalEnv> = async (c, next) => {
-  const sessionId = c.req.header("X-Impersonation-Session-Id");
-  if (!sessionId) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  const db = getDb();
-  const [session] = await db
-    .select()
-    .from(impersonationSessions)
-    .where(and(eq(impersonationSessions.id, sessionId), eq(impersonationSessions.status, "active")))
-    .limit(1);
-
-  if (!session || session.expiresAt <= new Date()) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  c.set("portalClientId", session.clientId);
-  c.set("portalSessionId", session.id);
-  await next();
-};

apps/api/src/middleware/rbac.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff } from "@groombook/db";
+import { eq, getDb, staff } from "@groombook/db";
 
 export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
@@ -89,31 +89,14 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
     .select()
     .from(staff)
     .where(eq(staff.oidcSub, jwt.sub));
-  if (fallbackRow) {
-    c.set("staff", fallbackRow);
-    await next();
-    return;
+  if (!fallbackRow) {
+    return c.json(
+      { error: "Forbidden: no staff record found for authenticated user" },
+      403
+    );
   }
-  // Auto-link by email: staff record exists with matching email but no userId
-  if (jwt.email) {
-    const [byEmail] = await db
-      .select()
-      .from(staff)
-      .where(and(eq(staff.email, jwt.email), sql`${staff.userId} IS NULL`));
-    if (byEmail) {
-      await db
-        .update(staff)
-        .set({ userId: jwt.sub, updatedAt: new Date() })
-        .where(eq(staff.id, byEmail.id));
-      c.set("staff", { ...byEmail, userId: jwt.sub });
-      await next();
-      return;
-    }
-  }
-  return c.json(
-    { error: "Forbidden: no staff record found for authenticated user" },
-    403
-  );
+  c.set("staff", fallbackRow);
+  await next();
 };
 
 /**
@@ -166,9 +149,9 @@ export function requireRoleOrSuperUser(
     }
     return c.json(
       {
-        error: hasAllowedRole
-          ? "Forbidden: super user privileges required"
-          : `Forbidden: role '${staffRow.role}' is not permitted`,
+        error: staffRow.isSuperUser
+          ? `Forbidden: role '${staffRow.role}' is not permitted`
+          : "Forbidden: super user privileges required",
       },
       403
     );

apps/api/src/routes/appointments.ts

@@ -23,27 +23,6 @@ import { buildConfirmationEmail, sendEmail } from "../services/email.js";
 import { notifyWaitlistForAppointment } from "../services/waitlistNotify.js";
 import type { AppEnv } from "../middleware/rbac.js";
 
-async function withRetry<T>(
-  fn: () => Promise<T>,
-  maxRetries: number,
-  delayMs: number,
-  context: string
-): Promise<void> {
-  let lastError: unknown;
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      await fn();
-      return;
-    } catch (err) {
-      lastError = err;
-      if (attempt < maxRetries) {
-        await new Promise((resolve) => setTimeout(resolve, delayMs));
-      }
-    }
-  }
-  console.error(`[appointments] ${context}: ${lastError}`);
-}
-
 export const appointmentsRouter = new Hono<AppEnv>();
 
 const createAppointmentSchema = z.object({
@@ -62,10 +41,6 @@ const createAppointmentSchema = z.object({
       frequencyWeeks: z.number().int().min(1).max(52),
       count: z.number().int().min(2).max(52),
     })
-    .refine(
-      (r) => r.frequencyWeeks * r.count <= 52,
-      { message: "Recurrence series must not exceed 1 year" }
-    )
     .optional(),
 });
 
@@ -233,54 +208,11 @@ appointmentsRouter.post(
           recurrence.frequencyWeeks * 7 * 24 * 60 * 60 * 1000;
 
         let first: typeof appointments.$inferSelect | undefined;
-        const conflictingInstances: number[] = [];
         for (let i = 0; i < recurrence.count; i++) {
           const instanceStart = new Date(start.getTime() + i * intervalMs);
           const instanceEnd = new Date(
             instanceStart.getTime() + durationMs
           );
-
-          if (apptFields.staffId) {
-            const conflicts = await tx
-              .select({ id: appointments.id })
-              .from(appointments)
-              .where(
-                and(
-                  eq(appointments.staffId, apptFields.staffId),
-                  lt(appointments.startTime, instanceEnd),
-                  gte(appointments.endTime, instanceStart),
-                  ne(appointments.status, "cancelled"),
-                  ne(appointments.status, "no_show"),
-                )
-              )
-              .limit(1);
-            if (conflicts.length > 0) {
-              conflictingInstances.push(i);
-            }
-          }
-
-          if (apptFields.batherStaffId) {
-            const conflicts = await tx
-              .select({ id: appointments.id })
-              .from(appointments)
-              .where(
-                and(
-                  or(
-                    eq(appointments.staffId, apptFields.batherStaffId),
-                    eq(appointments.batherStaffId, apptFields.batherStaffId)
-                  ),
-                  lt(appointments.startTime, instanceEnd),
-                  gte(appointments.endTime, instanceStart),
-                  ne(appointments.status, "cancelled"),
-                  ne(appointments.status, "no_show"),
-                )
-              )
-              .limit(1);
-            if (conflicts.length > 0) {
-              conflictingInstances.push(i);
-            }
-          }
-
           const [inserted] = await tx
             .insert(appointments)
             .values({
@@ -291,19 +223,9 @@ appointmentsRouter.post(
               seriesIndex: i,
             })
             .returning();
-          if (!inserted) throw new Error(`Insert failed for occurrence ${i}`);
           if (i === 0) first = inserted;
         }
 
-        if (conflictingInstances.length > 0) {
-          throw Object.assign(
-            new Error(
-              `Conflicts detected at occurrence(s): ${conflictingInstances.join(", ")}`
-            ),
-            { statusCode: 409 }
-          );
-        }
-
         if (!first) throw new Error("No appointments created");
         return first;
       });
@@ -321,12 +243,9 @@ appointmentsRouter.post(
     }
 
     // Send confirmation email (fire-and-forget — never fails the request)
-    withRetry(
-      () => sendConfirmationEmail(db, firstRow),
-      2,
-      1000,
-      `Failed to send confirmation email for appointment ${firstRow.id}`
-    );
+    sendConfirmationEmail(db, firstRow).catch((err) => {
+      console.error("[appointments] Failed to send confirmation email:", err);
+    });
 
     return c.json(firstRow, 201);
   }
@@ -455,76 +374,6 @@ appointmentsRouter.patch(
 
           let firstUpdated: typeof appointments.$inferSelect | undefined;
           for (const appt of affected) {
-            const newStart =
-              startDeltaMs !== 0
-                ? new Date(appt.startTime.getTime() + startDeltaMs)
-                : appt.startTime;
-            const newEnd =
-              endDeltaMs !== 0
-                ? new Date(appt.endTime.getTime() + endDeltaMs)
-                : appt.endTime;
-            const newStaffId =
-              updateFields.staffId !== undefined
-                ? updateFields.staffId
-                : appt.staffId;
-            const newBatherStaffId =
-              updateFields.batherStaffId !== undefined
-                ? updateFields.batherStaffId
-                : appt.batherStaffId;
-
-            if (
-              newStaffId &&
-              (startDeltaMs !== 0 ||
-                endDeltaMs !== 0 ||
-                updateFields.staffId !== undefined)
-            ) {
-              const conflicts = await tx
-                .select({ id: appointments.id })
-                .from(appointments)
-                .where(
-                  and(
-                    eq(appointments.staffId, newStaffId),
-                    lt(appointments.startTime, newEnd),
-                    gte(appointments.endTime, newStart),
-                    ne(appointments.status, "cancelled"),
-                    ne(appointments.status, "no_show"),
-                    ne(appointments.id, appt.id),
-                  )
-                )
-                .limit(1);
-              if (conflicts.length > 0) {
-                throw Object.assign(new Error("conflict"), { statusCode: 409 });
-              }
-            }
-
-            if (
-              newBatherStaffId &&
-              (startDeltaMs !== 0 ||
-                endDeltaMs !== 0 ||
-                updateFields.batherStaffId !== undefined)
-            ) {
-              const conflicts = await tx
-                .select({ id: appointments.id })
-                .from(appointments)
-                .where(
-                  and(
-                    or(
-                      eq(appointments.staffId, newBatherStaffId),
-                      eq(appointments.batherStaffId, newBatherStaffId)
-                    ),
-                    lt(appointments.startTime, newEnd),
-                    gte(appointments.endTime, newStart),
-                    ne(appointments.status, "cancelled"),
-                    ne(appointments.status, "no_show"),
-                    ne(appointments.id, appt.id),
-                  )
-                )
-                .limit(1);
-              if (conflicts.length > 0) {
-                throw Object.assign(new Error("conflict"), { statusCode: 409 });
-              }
-            }
-
             const apptUpdate: Record<string, unknown> = {
               updatedAt: new Date(),
             };
@@ -560,13 +409,6 @@ appointmentsRouter.patch(
         if (statusCode === 404) return c.json({ error: "Not found" }, 404);
         if (statusCode === 422)
           return c.json({ error: "endTime must be after startTime" }, 422);
-        if (statusCode === 409)
-          return c.json(
-            {
-              error: "Staff member has a conflicting appointment at this time",
-            },
-            409
-          );
         throw err;
       }
 
@@ -744,12 +586,9 @@ appointmentsRouter.delete("/:id", async (c) => {
 
     const apptDate = current.startTime.toISOString().slice(0, 10);
     const apptTime = current.startTime.toLocaleTimeString("en-US", { hour: "2-digit", minute: "2-digit", hour12: true });
-    withRetry(
-      () => notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId),
-      2,
-      1000,
-      `Failed to notify waitlist for appointment ${id}`
-    );
+    notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId).catch((err) => {
+      console.error("[appointments] Failed to notify waitlist:", err);
+    });
 
     return c.json({ ok: true });
   }
@@ -772,12 +611,9 @@ appointmentsRouter.delete("/:id", async (c) => {
     .returning();
   if (!row) return c.json({ error: "Not found" }, 404);
 
-  withRetry(
-    () => notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId),
-    2,
-    1000,
-    `Failed to notify waitlist for appointment ${id}`
-  );
+  notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId).catch((err) => {
+    console.error("[appointments] Failed to notify waitlist:", err);
+  });
 
   return c.json({ ok: true });
 });

apps/api/src/routes/book.ts

@@ -102,10 +102,7 @@ bookRouter.get("/availability", async (c) => {
 
 const bookingSchema = z.object({
   serviceId: z.string().uuid(),
-  startTime: z.string().datetime().refine(
-    (dt) => new Date(dt) > new Date(),
-    { message: "Appointment must be in the future" }
-  ),
+  startTime: z.string().datetime(),
   clientName: z.string().min(1).max(200),
   clientEmail: z.string().email(),
   clientPhone: z.string().max(50).optional(),
@@ -268,36 +265,29 @@ bookRouter.get("/confirm/:token", async (c) => {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
+  // Reject if appointment is in the past
   if (appt.startTime < new Date()) {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
+  // Idempotent confirm: if already confirmed, redirect to success
   if (appt.confirmationStatus === "confirmed") {
     return c.redirect(`${BASE_URL()}/booking/confirmed`);
   }
 
+  // Reject if already cancelled
   if (appt.confirmationStatus === "cancelled") {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  const updated = await db
+  await db
     .update(appointments)
     .set({
       confirmationStatus: "confirmed",
       confirmedAt: new Date(),
       updatedAt: new Date(),
     })
-    .where(
-      and(
-        eq(appointments.confirmationToken, token),
-        eq(appointments.confirmationStatus, "pending")
-      )
-    )
-    .returning();
-
-  if (updated.length === 0) {
-    return c.redirect(`${BASE_URL()}/booking/error`);
-  }
+    .where(eq(appointments.id, appt.id));
 
   return c.redirect(`${BASE_URL()}/booking/confirmed`);
 });
@@ -319,15 +309,19 @@ bookRouter.get("/cancel/:token", async (c) => {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
+  // Reject if appointment is in the past
   if (appt.startTime < new Date()) {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
+  // Reject if already cancelled (token was nullified — this path won't normally hit,
+  // but guard against edge cases where token lookup still works)
   if (appt.confirmationStatus === "cancelled") {
     return c.redirect(`${BASE_URL()}/booking/error`);
   }
 
-  const updated = await db
+  // Single-use cancellation: nullify token after use
+  await db
     .update(appointments)
     .set({
       confirmationStatus: "cancelled",
@@ -335,17 +329,7 @@ bookRouter.get("/cancel/:token", async (c) => {
       confirmationToken: null,
       updatedAt: new Date(),
     })
-    .where(
-      and(
-        eq(appointments.confirmationToken, token),
-        eq(appointments.confirmationStatus, "pending")
-      )
-    )
-    .returning();
-
-  if (updated.length === 0) {
-    return c.redirect(`${BASE_URL()}/booking/error`);
-  }
+    .where(eq(appointments.id, appt.id));
 
   return c.redirect(`${BASE_URL()}/booking/cancelled`);
 });

apps/api/src/routes/calendar.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import {
   and,
   eq,
@@ -84,18 +84,7 @@ calendarRouter.get("/:staffId.ics", async (c) => {
     .where(eq(staff.id, staffId))
     .limit(1);
 
-  if (!staffMember || !staffMember.icalToken) {
-    return c.text("Unauthorized", 401);
-  }
-
-  const storedToken = staffMember.icalToken;
-  const incomingToken = token;
-  const storedBuf = Buffer.from(storedToken, "utf8");
-  const incomingBuf = Buffer.from(incomingToken, "utf8");
-  if (
-    storedBuf.length !== incomingBuf.length ||
-    !timingSafeEqual(storedBuf, incomingBuf)
-  ) {
+  if (!staffMember || staffMember.icalToken !== token) {
     return c.text("Unauthorized", 401);
   }
 

apps/api/src/routes/clients.ts

@@ -135,24 +135,9 @@ clientsRouter.delete("/:id", async (c) => {
   }
 
   const db = getDb();
-  const clientId = c.req.param("id");
-
-  const [existingAppt] = await db
-    .select({ id: appointments.id })
-    .from(appointments)
-    .where(eq(appointments.clientId, clientId))
-    .limit(1);
-
-  if (existingAppt) {
-    return c.json(
-      { error: "Cannot delete client with existing appointments. Cancel or reassign appointments first." },
-      409
-    );
-  }
-
   const [row] = await db
     .delete(clients)
-    .where(eq(clients.id, clientId))
+    .where(eq(clients.id, c.req.param("id")))
     .returning();
   if (!row) return c.json({ error: "Not found" }, 404);
   return c.json({ ok: true });

apps/api/src/routes/invoices.ts

@@ -8,7 +8,6 @@ import {
   invoices,
   invoiceLineItems,
   invoiceTipSplits,
-  refunds,
   appointments,
   services,
   clients,
@@ -45,61 +44,53 @@ const updateInvoiceSchema = z.object({
 });
 
 // List invoices
-const listInvoicesQuerySchema = z.object({
-  clientId: z.string().uuid().optional(),
-  appointmentId: z.string().uuid().optional(),
-  status: z.enum(["draft", "pending", "paid", "void"]).optional(),
-  limit: z.coerce.number().int().min(1).max(200).default(50),
-  offset: z.coerce.number().int().min(0).default(0),
+invoicesRouter.get("/", async (c) => {
+  const db = getDb();
+  const clientId = c.req.query("clientId");
+  const appointmentId = c.req.query("appointmentId");
+  const status = c.req.query("status");
+  const limit = Math.min(parseInt(c.req.query("limit") || "50", 10), 200);
+  const offset = parseInt(c.req.query("offset") || "0", 10);
+
+  const conditions = [];
+  if (clientId) conditions.push(eq(invoices.clientId, clientId));
+  if (appointmentId) conditions.push(eq(invoices.appointmentId, appointmentId));
+  if (status) conditions.push(eq(invoices.status, status as "draft" | "pending" | "paid" | "void"));
+
+  const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
+
+  const [totalResult] = await db
+    .select({ count: sql<number>`count(*)` })
+    .from(invoices)
+    .where(whereClause);
+
+  const rows = await db
+    .select({
+      id: invoices.id,
+      appointmentId: invoices.appointmentId,
+      clientId: invoices.clientId,
+      clientName: clients.name,
+      subtotalCents: invoices.subtotalCents,
+      taxCents: invoices.taxCents,
+      tipCents: invoices.tipCents,
+      totalCents: invoices.totalCents,
+      status: invoices.status,
+      paymentMethod: invoices.paymentMethod,
+      paidAt: invoices.paidAt,
+      notes: invoices.notes,
+      createdAt: invoices.createdAt,
+      updatedAt: invoices.updatedAt,
+    })
+    .from(invoices)
+    .leftJoin(clients, eq(invoices.clientId, clients.id))
+    .where(whereClause)
+    .orderBy(invoices.createdAt)
+    .limit(limit)
+    .offset(offset);
+
+  return c.json({ data: rows, total: totalResult?.count ?? 0 });
 });
 
-invoicesRouter.get(
-  "/",
-  zValidator("query", listInvoicesQuerySchema),
-  async (c) => {
-    const db = getDb();
-    const { clientId, appointmentId, status, limit, offset } = c.req.valid("query");
-
-    const conditions = [];
-    if (clientId) conditions.push(eq(invoices.clientId, clientId));
-    if (appointmentId) conditions.push(eq(invoices.appointmentId, appointmentId));
-    if (status) conditions.push(eq(invoices.status, status as "draft" | "pending" | "paid" | "void"));
-
-    const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
-
-    const [totalResult] = await db
-      .select({ count: sql<number>`count(*)` })
-      .from(invoices)
-      .where(whereClause);
-
-    const rows = await db
-      .select({
-        id: invoices.id,
-        appointmentId: invoices.appointmentId,
-        clientId: invoices.clientId,
-        clientName: clients.name,
-        subtotalCents: invoices.subtotalCents,
-        taxCents: invoices.taxCents,
-        tipCents: invoices.tipCents,
-        totalCents: invoices.totalCents,
-        status: invoices.status,
-        paymentMethod: invoices.paymentMethod,
-        paidAt: invoices.paidAt,
-        notes: invoices.notes,
-        createdAt: invoices.createdAt,
-        updatedAt: invoices.updatedAt,
-      })
-      .from(invoices)
-      .leftJoin(clients, eq(invoices.clientId, clients.id))
-      .where(whereClause)
-      .orderBy(invoices.createdAt)
-      .limit(limit)
-      .offset(offset);
-
-    return c.json({ data: rows, total: totalResult?.count ?? 0 });
-  }
-);
-
 // Get single invoice with line items and tip splits
 invoicesRouter.get("/:id", async (c) => {
   const db = getDb();
@@ -126,8 +117,8 @@ const tipSplitSchema = z.object({
     })
   ).min(1).refine(
     (splits) => {
-      const totalBps = splits.reduce((sum, s) => sum + Math.round(s.sharePct * 100), 0);
-      return totalBps === 10000;
+      const total = splits.reduce((sum, s) => sum + s.sharePct, 0);
+      return Math.abs(total - 100) < 0.01;
     },
     { message: "Split percentages must sum to 100" }
   ),
@@ -171,13 +162,12 @@ invoicesRouter.post(
       }
     });
 
-    const [updatedInvoice] = await db.select().from(invoices).where(eq(invoices.id, id));
-    const [lineItems, tipSplits] = await Promise.all([
-      db.select().from(invoiceLineItems).where(eq(invoiceLineItems.invoiceId, id)),
-      db.select().from(invoiceTipSplits).where(eq(invoiceTipSplits.invoiceId, id)),
-    ]);
+    const splits = await db
+      .select()
+      .from(invoiceTipSplits)
+      .where(eq(invoiceTipSplits.invoiceId, id));
 
-    return c.json({ ...updatedInvoice, lineItems, tipSplits }, 201);
+    return c.json(splits, 201);
   }
 );
 
@@ -302,13 +292,6 @@ invoicesRouter.post("/from-appointment/:appointmentId", async (c) => {
   return c.json({ ...invoice, lineItems: [lineItem] }, 201);
 });
 
-const ALLOWED_TRANSITIONS: Record<string, string[]> = {
-  draft: ["pending", "void"],
-  pending: ["draft", "paid", "void"],
-  paid: ["void"],
-  void: [],
-};
-
 // Update invoice
 invoicesRouter.patch(
   "/:id",
@@ -324,14 +307,8 @@ invoicesRouter.patch(
       .where(eq(invoices.id, id));
     if (!current) return c.json({ error: "Not found" }, 404);
 
-    if (body.status !== undefined) {
-      const allowed = ALLOWED_TRANSITIONS[current.status] ?? [];
-      if (!allowed.includes(body.status)) {
-        return c.json(
-          { error: `Invalid status transition from ${current.status} to ${body.status}` },
-          422
-        );
-      }
+    if (current.status === "void") {
+      return c.json({ error: "Cannot modify a voided invoice" }, 422);
     }
 
     const update: Record<string, unknown> = { ...body, updatedAt: new Date() };
@@ -369,7 +346,6 @@ import { processRefund } from "../services/payment.js";
 
 const refundSchema = z.object({
   amountCents: z.number().int().nonnegative().optional(),
-  idempotencyKey: z.string().max(255).optional(),
 });
 
 invoicesRouter.post(
@@ -395,28 +371,9 @@ invoicesRouter.post(
       return c.json({ error: "No Stripe payment intent found for this invoice" }, 422);
     }
 
-    return await db.transaction(async (tx) => {
-      if (body.idempotencyKey) {
-        const [existing] = await tx
-          .select()
-          .from(refunds)
-          .where(eq(refunds.idempotencyKey, body.idempotencyKey));
-        if (existing) {
-          return c.json({ refundId: existing.stripeRefundId });
-        }
-      }
+    const result = await processRefund(id, body.amountCents);
+    if (!result) return c.json({ error: "Refund failed" }, 500);
 
-      const result = await processRefund(id, body.amountCents);
-      if (!result) return c.json({ error: "Refund failed" }, 500);
-
-      await tx.insert(refunds).values({
-        invoiceId: id,
-        stripeRefundId: result.refundId,
-        idempotencyKey: body.idempotencyKey ?? null,
-        amountCents: body.amountCents ?? null,
-      });
-
-      return c.json({ refundId: result.refundId });
-    });
+    return c.json({ refundId: result.refundId });
   }
 );

apps/api/src/routes/portal.ts

@@ -1,22 +1,33 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { eq, inArray } from "@groombook/db";
+import { and, eq, inArray } from "@groombook/db";
 import { getDb, appointments, impersonationSessions, waitlistEntries, clients, pets, services, staff, invoices, invoiceLineItems } from "@groombook/db";
-import { validatePortalSession } from "../middleware/portalSession.js";
-import { portalAudit } from "../middleware/portalAudit.js";
-import type { PortalEnv } from "../middleware/portalSession.js";
+import type { AppEnv } from "../middleware/rbac.js";
 
-export const portalRouter = new Hono<PortalEnv>();
+export const portalRouter = new Hono<AppEnv>();
 
-// Apply middleware to all portal routes
-portalRouter.use("/*", validatePortalSession, portalAudit);
+// ─── Session helper ───────────────────────────────────────────────────────────
+
+async function getClientIdFromSession(sessionId: string | null | undefined): Promise<string | null> {
+  if (!sessionId) return null;
+  const db = getDb();
+  const [session] = await db
+    .select()
+    .from(impersonationSessions)
+    .where(and(eq(impersonationSessions.id, sessionId), eq(impersonationSessions.status, "active")))
+    .limit(1);
+  if (!session || session.expiresAt <= new Date()) return null;
+  return session.clientId;
+}
 
 // ─── GET routes ──────────────────────────────────────────────────────────────
 
 portalRouter.get("/me", async (c) => {
   const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const [client] = await db.select().from(clients).where(eq(clients.id, clientId)).limit(1);
   if (!client) return c.json({ error: "Not found" }, 404);
@@ -38,7 +49,9 @@ portalRouter.get("/services", async (c) => {
 
 portalRouter.get("/appointments", async (c) => {
   const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const now = new Date();
   const allAppts = await db
@@ -88,7 +101,9 @@ portalRouter.get("/appointments", async (c) => {
 
 portalRouter.get("/pets", async (c) => {
   const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const clientPets = await db.select().from(pets).where(eq(pets.clientId, clientId));
   return c.json(clientPets.map(p => ({ id: p.id, name: p.name, breed: p.breed, weightKg: p.weightKg, dateOfBirth: p.dateOfBirth, photoKey: p.photoKey, groomingNotes: p.groomingNotes })));
@@ -96,7 +111,9 @@ portalRouter.get("/pets", async (c) => {
 
 portalRouter.get("/invoices", async (c) => {
   const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const clientInvoices = await db.select().from(invoices).where(eq(invoices.clientId, clientId));
   const invoiceIds = clientInvoices.map(i => i.id);
@@ -131,7 +148,12 @@ portalRouter.patch(
     const db = getDb();
     const id = c.req.param("id");
     const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+    const clientId = await getClientIdFromSession(sessionId);
+    if (!clientId) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
 
     const [appt] = await db
       .select()
@@ -174,7 +196,12 @@ portalRouter.patch(
 portalRouter.post("/appointments/:id/confirm", async (c) => {
   const db = getDb();
   const id = c.req.param("id");
-  const clientId = c.get("portalClientId");
+
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
 
   const [appt] = await db
     .select()
@@ -223,7 +250,12 @@ portalRouter.post("/appointments/:id/confirm", async (c) => {
 portalRouter.post("/appointments/:id/cancel", async (c) => {
   const db = getDb();
   const id = c.req.param("id");
-  const clientId = c.get("portalClientId");
+
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
 
   const [appt] = await db
     .select()
@@ -287,7 +319,28 @@ portalRouter.post(
   async (c) => {
     const db = getDb();
     const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+
+    let clientId: string | null = null;
+    if (sessionId) {
+      const [session] = await db
+        .select()
+        .from(impersonationSessions)
+        .where(
+          and(
+            eq(impersonationSessions.id, sessionId),
+            eq(impersonationSessions.status, "active")
+          )
+        )
+        .limit(1);
+      if (session && session.expiresAt > new Date()) {
+        clientId = session.clientId;
+      }
+    }
+
+    if (!clientId) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
 
     const [entry] = await db
       .insert(waitlistEntries)
@@ -311,7 +364,26 @@ portalRouter.patch(
     const db = getDb();
     const id = c.req.param("id");
     const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+
+    if (!sessionId) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
+    const [session] = await db
+      .select()
+      .from(impersonationSessions)
+      .where(
+        and(
+          eq(impersonationSessions.id, sessionId),
+          eq(impersonationSessions.status, "active")
+        )
+      )
+      .limit(1);
+
+    if (!session || session.expiresAt <= new Date()) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
 
     const [existing] = await db
       .select()
@@ -320,7 +392,7 @@ portalRouter.patch(
       .limit(1);
 
     if (!existing) return c.json({ error: "Not found" }, 404);
-    if (existing.clientId !== clientId) {
+    if (existing.clientId !== session.clientId) {
       return c.json({ error: "Forbidden" }, 403);
     }
 
@@ -342,7 +414,26 @@ portalRouter.patch(
 portalRouter.delete("/waitlist/:id", async (c) => {
   const db = getDb();
   const id = c.req.param("id");
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+
+  if (!sessionId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+
+  const [session] = await db
+    .select()
+    .from(impersonationSessions)
+    .where(
+      and(
+        eq(impersonationSessions.id, sessionId),
+        eq(impersonationSessions.status, "active")
+      )
+    )
+    .limit(1);
+
+  if (!session || session.expiresAt <= new Date()) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
 
   const [entry] = await db
     .select()
@@ -351,7 +442,7 @@ portalRouter.delete("/waitlist/:id", async (c) => {
     .limit(1);
 
   if (!entry) return c.json({ error: "Not found" }, 404);
-  if (entry.clientId !== clientId) {
+  if (entry.clientId !== session.clientId) {
     return c.json({ error: "Forbidden" }, 403);
   }
 
@@ -384,7 +475,9 @@ portalRouter.post(
   async (c) => {
     const db = getDb();
     const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+    const clientId = await getClientIdFromSession(sessionId);
+    if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
     const invoiceRows = await db
       .select()
@@ -421,7 +514,9 @@ portalRouter.post(
 );
 
 portalRouter.get("/payment-methods", async (c) => {
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const methods = await listPaymentMethods(clientId);
   if (methods === null) return c.json({ error: "Payment service unavailable" }, 503);
@@ -429,7 +524,9 @@ portalRouter.get("/payment-methods", async (c) => {
 });
 
 portalRouter.post("/payment-methods", async (c) => {
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const stripePublishableKey = process.env.STRIPE_PUBLISHABLE_KEY ?? "";
   const customerId = await getOrCreateStripeCustomer(clientId);
@@ -442,7 +539,9 @@ portalRouter.post("/payment-methods", async (c) => {
 });
 
 portalRouter.delete("/payment-methods/:id", async (c) => {
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const paymentMethodId = c.req.param("id");
 

apps/api/src/routes/services.ts

@@ -9,7 +9,7 @@ const createServiceSchema = z.object({
   name: z.string().min(1).max(200),
   description: z.string().max(2000).optional(),
   basePriceCents: z.number().int().positive(),
-  durationMinutes: z.number().int().positive().max(480),
+  durationMinutes: z.number().int().positive(),
   active: z.boolean().default(true),
 });
 

apps/api/src/routes/setup.ts

@@ -4,24 +4,6 @@ import { z } from "zod/v3";
 import { and, eq, getDb, sql, staff, businessSettings, authProviderConfig, encryptSecret } from "@groombook/db";
 import type { AppEnv } from "../middleware/rbac.js";
 
-const RATE_LIMIT_WINDOW_MS = 60_000;
-const RATE_LIMIT_MAX = 10;
-const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
-
-function rateLimitByIp(ip: string): { allowed: boolean; remaining: number } {
-  const now = Date.now();
-  const entry = rateLimitMap.get(ip);
-  if (!entry || now > entry.resetAt) {
-    rateLimitMap.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
-    return { allowed: true, remaining: RATE_LIMIT_MAX - 1 };
-  }
-  if (entry.count >= RATE_LIMIT_MAX) {
-    return { allowed: false, remaining: 0 };
-  }
-  entry.count++;
-  return { allowed: true, remaining: RATE_LIMIT_MAX - entry.count };
-}
-
 export const setupRouter = new Hono<AppEnv>();
 
 // GET /api/setup/status — public (no auth), returns whether setup is needed
@@ -203,74 +185,52 @@ const authProviderTestSchema = z.object({
  * After setup completes, this endpoint permanently returns 403.
  */
 setupRouter.post("/auth-provider", async (c) => {
-  const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-  const { allowed, remaining } = rateLimitByIp(ip);
-  c.res.headers.set("x-rate-limit-remaining", String(remaining));
-  if (!allowed) {
-    return c.json({ error: "Too many requests. Please try again later." }, 429);
-  }
-
   const db = getDb();
 
-  let row: typeof authProviderConfig.$inferSelect;
-  try {
-    row = await db.transaction(async (tx) => {
-      const [superUser] = await tx
-        .select({ id: staff.id })
-        .from(staff)
-        .where(eq(staff.isSuperUser, true))
-        .limit(1);
+  // Guard: only allow during fresh install (no super user yet)
+  const [superUser] = await db
+    .select({ id: staff.id })
+    .from(staff)
+    .where(eq(staff.isSuperUser, true))
+    .limit(1);
 
-      if (superUser) {
-        throw Object.assign(new Error("setup-complete"), { code: 403 });
-      }
+  if (superUser) {
+    // Setup already completed — lock this endpoint permanently
+    return c.json({ error: "Setup has already been completed. This endpoint is no longer available." }, 403);
+  }
 
-      const [existingConfig] = await tx
-        .select({ id: authProviderConfig.id })
-        .from(authProviderConfig)
-        .where(eq(authProviderConfig.enabled, true))
-        .limit(1);
+  // Guard: ensure no DB config already exists (should be redundant with status check but defensive)
+  const [existingConfig] = await db
+    .select({ id: authProviderConfig.id })
+    .from(authProviderConfig)
+    .where(eq(authProviderConfig.enabled, true))
+    .limit(1);
 
-      if (existingConfig) {
-        throw Object.assign(new Error("config-exists"), { code: 409 });
-      }
+  if (existingConfig) {
+    return c.json({ error: "Auth provider is already configured." }, 409);
+  }
 
-      const body = authProviderBootstrapSchema.parse(await c.req.json());
+  const body = authProviderBootstrapSchema.parse(await c.req.json());
 
-      const encryptedSecret = encryptSecret(body.clientSecret);
+  // Encrypt clientSecret before storing
+  const encryptedSecret = encryptSecret(body.clientSecret);
 
-      const [configRow] = await tx
-        .insert(authProviderConfig)
-        .values({
-          providerId: body.providerId,
-          displayName: body.displayName,
-          issuerUrl: body.issuerUrl,
-          internalBaseUrl: body.internalBaseUrl ?? null,
-          clientId: body.clientId,
-          clientSecret: encryptedSecret,
-          scopes: body.scopes,
-          enabled: true,
-        })
-        .returning();
+  const [row] = await db
+    .insert(authProviderConfig)
+    .values({
+      providerId: body.providerId,
+      displayName: body.displayName,
+      issuerUrl: body.issuerUrl,
+      internalBaseUrl: body.internalBaseUrl ?? null,
+      clientId: body.clientId,
+      clientSecret: encryptedSecret,
+      scopes: body.scopes,
+      enabled: true,
+    })
+    .returning();
 
-      if (!configRow) {
-        throw Object.assign(new Error("insert-failed"), { code: 500 });
-      }
-
-      return configRow;
-    });
-  } catch (err: unknown) {
-    const e = err as Error & { code?: number };
-    if (e.message === "setup-complete") {
-      return c.json({ error: "Setup has already been completed. This endpoint is no longer available." }, e.code as 403);
-    }
-    if (e.message === "config-exists") {
-      return c.json({ error: "Auth provider is already configured." }, e.code as 409);
-    }
-    if (e.message === "insert-failed") {
-      return c.json({ error: "Failed to save auth provider configuration." }, e.code as 500);
-    }
-    throw err;
+  if (!row) {
+    return c.json({ error: "Failed to save auth provider configuration." }, 500);
   }
 
   return c.json({
@@ -294,13 +254,6 @@ setupRouter.post("/auth-provider", async (c) => {
  * Only available when needsSetup is true (no super user = fresh install).
  */
 setupRouter.post("/auth-provider/test", async (c) => {
-  const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-  const { allowed, remaining } = rateLimitByIp(ip);
-  c.res.headers.set("x-rate-limit-remaining", String(remaining));
-  if (!allowed) {
-    return c.json({ ok: false, error: "Too many requests. Please try again later." }, 429);
-  }
-
   const db = getDb();
 
   // Guard: only allow during fresh install (no super user yet)

apps/api/src/routes/stripe-webhooks.ts

@@ -1,6 +1,5 @@
 import { Hono } from "hono";
 import Stripe from "stripe";
-import { z } from "zod/v3";
 import { eq, getDb, invoices } from "@groombook/db";
 import { getStripeClient } from "../services/payment.js";
 
@@ -45,13 +44,10 @@ webhooksRouter.post("/stripe", async (c) => {
       const invoiceIds = pi.metadata.groombook_invoice_ids.split(",");
       for (const invoiceId of invoiceIds) {
         if (!invoiceId) continue;
-        const parsed = z.string().uuid().safeParse(invoiceId.trim());
-        if (!parsed.success) continue;
-        const invoiceIdTrimmed = invoiceId.trim();
         const [inv] = await db
           .select()
           .from(invoices)
-          .where(eq(invoices.id, invoiceIdTrimmed))
+          .where(eq(invoices.id, invoiceId))
           .limit(1);
         if (!inv) continue;
         if (inv.stripePaymentIntentId && inv.stripePaymentIntentId !== pi.id) continue;
@@ -64,7 +60,7 @@ webhooksRouter.post("/stripe", async (c) => {
             stripePaymentIntentId: pi.id,
             updatedAt: new Date(),
           })
-          .where(eq(invoices.id, invoiceIdTrimmed));
+          .where(eq(invoices.id, invoiceId));
       }
     }
   } else if (event.type === "payment_intent.payment_failed") {
@@ -73,16 +69,13 @@ webhooksRouter.post("/stripe", async (c) => {
       const invoiceIds = pi.metadata.groombook_invoice_ids.split(",");
       for (const invoiceId of invoiceIds) {
         if (!invoiceId) continue;
-        const parsed = z.string().uuid().safeParse(invoiceId.trim());
-        if (!parsed.success) continue;
-        const invoiceIdTrimmed = invoiceId.trim();
         await db
           .update(invoices)
           .set({
             paymentFailureReason: pi.last_payment_error?.message ?? "Payment failed",
             updatedAt: new Date(),
           })
-          .where(eq(invoices.id, invoiceIdTrimmed));
+          .where(eq(invoices.id, invoiceId));
       }
     }
   } else if (event.type === "charge.refunded") {

packages/db/migrations/0027_refunds.sql

@@ -1,11 +0,0 @@
-CREATE TABLE "refunds" (
-  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  "invoice_id" uuid NOT NULL REFERENCES "invoices"("id") ON DELETE RESTRICT,
-  "stripe_refund_id" text NOT NULL,
-  "idempotency_key" text UNIQUE,
-  "amount_cents" integer,
-  "created_at" timestamp NOT NULL DEFAULT NOW()
-);
-
-CREATE INDEX "idx_refunds_invoice_id" ON "refunds"("invoice_id");
-CREATE INDEX "idx_refunds_idempotency_key" ON "refunds"("idempotency_key");

packages/db/migrations/meta/_journal.json

@@ -190,13 +190,6 @@
       "when": 1775568867192,
       "tag": "0026_stripe_payment",
       "breakpoints": true
-    },
-    {
-      "idx": 27,
-      "version": "7",
-      "when": 1775655267192,
-      "tag": "0027_refunds",
-      "breakpoints": true
     }
   ]
 }

packages/db/src/schema.ts

@@ -300,25 +300,6 @@ export const invoiceTipSplits = pgTable(
   (t) => [index("idx_invoice_tip_splits_invoice_id").on(t.invoiceId)]
 );
 
-// Refund records with idempotency key support
-export const refunds = pgTable(
-  "refunds",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    invoiceId: uuid("invoice_id")
-      .notNull()
-      .references(() => invoices.id, { onDelete: "restrict" }),
-    stripeRefundId: text("stripe_refund_id").notNull(),
-    idempotencyKey: text("idempotency_key").unique(),
-    amountCents: integer("amount_cents"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-  },
-  (t) => [
-    index("idx_refunds_invoice_id").on(t.invoiceId),
-    index("idx_refunds_idempotency_key").on(t.idempotencyKey),
-  ]
-);
-
 // Tracks which reminder emails have been sent per appointment (prevents duplicates).
 // reminder_type values: "confirmation", "24h", "2h"
 export const reminderLogs = pgTable(