feat(GRO-566): add SKIP_OOBE env var to bypass setup wizard

SKIP_OOBE=true|1|yes causes GET /api/setup/status to return
needsSetup: false regardless of DB state. Useful in dev/test
environments where the DB has data but OOBE would block access.

Changes:
- apps/api/src/routes/setup.ts: SKIP_OOBE check in GET /status
- .env.example: document SKIP_OOBE=false
- apps/api/src/__tests__/setup.test.ts: cover SKIP_OOBE=true|1|yes

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.env.example

@@ -11,6 +11,12 @@ AUTH_DISABLED=false
 OIDC_ISSUER=https://authentik.example.com
 OIDC_AUDIENCE=groombook
 
+# ── Setup Wizard ─────────────────────────────────────────────────────────────
+# When SKIP_OOBE=true, the setup wizard is bypassed regardless of whether a
+# super user exists in the database. Useful in dev/test environments where the
+# database has data but the setup wizard would otherwise block access.
+SKIP_OOBE=false
+
 # ── API ───────────────────────────────────────────────────────────────────────
 PORT=3000
 CORS_ORIGIN=http://localhost:8080

apps/api/src/__tests__/setup.test.ts

@@ -418,6 +418,48 @@ describe("GET /setup/status — OOBE bootstrap logic", () => {
     expect(body.showAuthProviderStep).toBe(false); // DB config already exists
     expect(body.authConfigExists).toBe(true);
   });
+
+  it("SKIP_OOBE=true bypasses setup check regardless of DB state", async () => {
+    dbStaffRows = []; // no super user
+    dbAuthConfigRows = [];
+    process.env.SKIP_OOBE = "true";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.showAuthProviderStep).toBe(false);
+    expect(body.authConfigExists).toBe(false);
+    expect(body.authEnvVarsSet).toBe(false);
+    expect(body.skipped).toBe(true);
+  });
+
+  it("SKIP_OOBE=1 also bypasses setup check", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+    process.env.SKIP_OOBE = "1";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.skipped).toBe(true);
+  });
+
+  it("SKIP_OOBE=yes also bypasses setup check", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+    process.env.SKIP_OOBE = "yes";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.skipped).toBe(true);
+  });
 });
 
 describe("POST /setup/auth-provider — OOBE bootstrap", () => {

apps/api/src/index.ts

@@ -105,7 +105,13 @@ api.use("*", resolveStaffMiddleware);
 // Better-Auth handler — mounted as sub-app to handle all /api/auth/* routes
 // authMiddleware and resolveStaffMiddleware both skip /api/auth/ paths
 const authRouter = new Hono();
-authRouter.all("/*", (c) => getAuth().handler(c.req.raw));
+authRouter.all("/*", (c) => {
+  try {
+    return getAuth().handler(c.req.raw);
+  } catch {
+    return c.json({ error: "Authentication not configured" }, 503);
+  }
+});
 api.route("/auth", authRouter);
 
 // ── Role guards ────────────────────────────────────────────────────────────────

apps/api/src/lib/auth.ts

@@ -1,9 +1,9 @@
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { genericOAuth } from "better-auth/plugins";
-import { google, github } from "better-auth/social-providers";
 import { getDb, authProviderConfig, eq } from "@groombook/db";
 import { decryptSecret } from "@groombook/db";
+import { sendEmail } from "../services/email.js";
 
 const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
 const BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://localhost:3000";
@@ -91,6 +91,12 @@ export async function initAuth(): Promise<void> {
         database: drizzleAdapter(getDb(), { provider: "pg" }),
         secret: BETTER_AUTH_SECRET ?? "placeholder-secret-do-not-use-in-prod",
         baseURL: BETTER_AUTH_URL,
+        rateLimit: {
+          enabled: true,
+          max: 10,
+          window: 60,
+          storage: "database",
+        },
         plugins: [
           genericOAuth({
             config: [
@@ -171,18 +177,50 @@ export async function initAuth(): Promise<void> {
     const hasGoogle = !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
     const hasGitHub = !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET);
 
-    const socialPlugins = [];
-    if (hasGoogle) {
-      socialPlugins.push(google({
-        clientId: process.env.GOOGLE_CLIENT_ID!,
-        clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
-      }));
-    }
-    if (hasGitHub) {
-      socialPlugins.push(github({
-        clientId: process.env.GITHUB_CLIENT_ID!,
-        clientSecret: process.env.GITHUB_CLIENT_SECRET!,
-      }));
+    // Fetch OIDC discovery document to derive canonical provider URLs.
+    // Replace the host of token/userinfo endpoints with internalBaseUrl when set,
+    // while keeping authorizationUrl public for browser redirects.
+    const discoveryUrlStr = `${providerConfig.issuerUrl}/.well-known/openid-configuration`;
+    let oidcConfig: Record<string, string> = {};
+    try {
+      const discoveryRes = await fetch(discoveryUrlStr);
+      if (discoveryRes.ok) {
+        const discovery = await discoveryRes.json() as {
+          authorization_endpoint?: string;
+          token_endpoint?: string;
+          userinfo_endpoint?: string;
+        };
+        const replaceHost = (url: string, newHost: string) => {
+          try {
+            const parsed = new URL(url);
+            const newParsed = new URL(newHost);
+            return `${newParsed.origin}${parsed.pathname}${parsed.search}`;
+          } catch {
+            return url;
+          }
+        };
+        const authzUrl = discovery.authorization_endpoint;
+        const tokenUrl = discovery.token_endpoint;
+        const userInfoUrl = discovery.userinfo_endpoint;
+        if (authzUrl && tokenUrl && userInfoUrl) {
+          oidcConfig = {
+            authorizationUrl: authzUrl,
+            tokenUrl: providerConfig.internalBaseUrl
+              ? replaceHost(tokenUrl, providerConfig.internalBaseUrl)
+              : tokenUrl,
+            userInfoUrl: providerConfig.internalBaseUrl
+              ? replaceHost(userInfoUrl, providerConfig.internalBaseUrl)
+              : userInfoUrl,
+          };
+          console.log("[auth] OIDC discovery successful, provider:", providerConfig.providerId);
+        } else {
+          console.warn("[auth] OIDC discovery missing required endpoints, using discoveryUrl only");
+        }
+      } else {
+        console.warn(`[auth] OIDC discovery failed (${discoveryRes.status}), using discoveryUrl only`);
+      }
+    } catch (err) {
+      console.warn(`[auth] OIDC discovery fetch failed: ${err}, using discoveryUrl only`);
     }
 
     // Build Better-Auth instance using resolved config
@@ -192,6 +230,28 @@ export async function initAuth(): Promise<void> {
       }),
       secret: BETTER_AUTH_SECRET,
       baseURL: BETTER_AUTH_URL,
+      rateLimit: {
+        enabled: true,
+        max: 10,
+        window: 60,
+        storage: "database",
+      },
+      account: {
+        storeStateStrategy: "cookie" as const,
+      },
+      emailAndPassword: {
+        enabled: true,
+        emailVerification: {
+          sendVerificationEmail: async ({ user, url }: { user: { email: string }; url: string }) => {
+            await sendEmail({
+              to: user.email,
+              subject: "Verify your GroomBook email",
+              text: `Click the link to verify your email: ${url}`,
+              html: `<p>Click the link to verify your email:</p><a href="${url}">${url}</a>`,
+            });
+          },
+        },
+      },
       plugins: [
         genericOAuth({
           config: [
@@ -199,21 +259,27 @@ export async function initAuth(): Promise<void> {
               providerId: providerConfig.providerId,
               clientId: providerConfig.clientId,
               clientSecret: providerConfig.clientSecret,
-              ...(providerConfig.internalBaseUrl
-                ? {
-                    authorizationUrl: `${new URL(providerConfig.issuerUrl).origin}/application/o/authorize/`,
-                    tokenUrl: `${providerConfig.internalBaseUrl}/application/o/token/`,
-                    userInfoUrl: `${providerConfig.internalBaseUrl}/application/o/userinfo/`,
-                  }
-                : {
-                    discoveryUrl: `${providerConfig.issuerUrl}/.well-known/openid-configuration`,
-                  }),
+              discoveryUrl: discoveryUrlStr,
+              ...(Object.keys(oidcConfig).length > 0 ? oidcConfig : {}),
               scopes: providerConfig.scopes.split(" ").filter(Boolean),
             },
           ],
         }),
-        ...socialPlugins,
       ],
+      socialProviders: {
+        ...(hasGoogle ? {
+          google: {
+            clientId: process.env.GOOGLE_CLIENT_ID!,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+          },
+        } : {}),
+        ...(hasGitHub ? {
+          github: {
+            clientId: process.env.GITHUB_CLIENT_ID!,
+            clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+          },
+        } : {}),
+      },
       session: {
         expiresIn: 60 * 60 * 24 * 7, // 7 days
         updateAge: 60 * 60 * 24, // 1 day

apps/api/src/middleware/auth.ts

@@ -23,7 +23,6 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  // Better-Auth's own routes handle their own auth (OAuth callbacks, session mgmt)
   if (c.req.path.startsWith("/api/auth/")) {
     await next();
     return;
@@ -37,7 +36,14 @@ export const authMiddleware: MiddlewareHandler = async (c, next) => {
     return;
   }
 
-  const session = await getAuth().api.getSession({
+  let auth;
+  try {
+    auth = getAuth();
+  } catch {
+    return c.json({ error: "Authentication not configured" }, 503);
+  }
+
+  const session = await auth.api.getSession({
     headers: c.req.raw.headers,
   });
 

apps/api/src/middleware/rbac.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, isNull, staff } from "@groombook/db";
+import { eq, getDb, staff } from "@groombook/db";
 
 export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
@@ -90,25 +90,6 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
     .from(staff)
     .where(eq(staff.oidcSub, jwt.sub));
   if (!fallbackRow) {
-    // Auto-link: staff record exists with matching email but no userId — link it now
-    if (jwt.email) {
-      const [linkedStaff] = await db
-        .select()
-        .from(staff)
-        .where(and(eq(staff.email, jwt.email), isNull(staff.userId)));
-      if (linkedStaff) {
-        await db
-          .update(staff)
-          .set({ userId: jwt.sub })
-          .where(eq(staff.id, linkedStaff.id));
-        console.log(
-          `[rbac] Auto-linked staff ${linkedStaff.id} to Better-Auth user ${jwt.sub} via email ${jwt.email}`
-        );
-        c.set("staff", linkedStaff);
-        await next();
-        return;
-      }
-    }
     return c.json(
       { error: "Forbidden: no staff record found for authenticated user" },
       403

apps/api/src/routes/setup.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { and, eq, getDb, sql, staff, businessSettings, authProviderConfig, encryptSecret } from "@groombook/db";
+import { eq, getDb, staff, businessSettings, authProviderConfig, encryptSecret } from "@groombook/db";
 import type { AppEnv } from "../middleware/rbac.js";
 
 export const setupRouter = new Hono<AppEnv>();
@@ -9,6 +9,17 @@ export const setupRouter = new Hono<AppEnv>();
 // GET /api/setup/status — public (no auth), returns whether setup is needed
 // and whether the auth provider bootstrap step should be shown
 setupRouter.get("/status", async (c) => {
+  const skipOobe = ["true", "1", "yes"].includes((process.env.SKIP_OOBE || "").toLowerCase());
+  if (skipOobe) {
+    return c.json({
+      needsSetup: false,
+      showAuthProviderStep: false,
+      authConfigExists: false,
+      authEnvVarsSet: false,
+      skipped: true,
+    });
+  }
+
   const db = getDb();
 
   // Check if any super user exists
@@ -97,21 +108,6 @@ setupRouter.post("/", zValidator("json", setupSchema), async (c) => {
       }
     }
 
-    if (!resolvedStaff && jwt.email) {
-      // Try auto-link by email: staff record exists with matching email but no userId
-      const [byEmail] = await tx
-        .select()
-        .from(staff)
-        .where(and(eq(staff.email, jwt.email), sql`${staff.userId} IS NULL`));
-      if (byEmail) {
-        await tx
-          .update(staff)
-          .set({ userId: jwt.sub })
-          .where(eq(staff.id, byEmail.id));
-        resolvedStaff = { ...byEmail, userId: jwt.sub };
-      }
-    }
-
     if (!resolvedStaff) {
       // Brand new user during OOBE — create staff record
       if (!jwt.email) {

apps/api/src/routes/staff.ts

@@ -18,6 +18,10 @@ const createStaffSchema = z.object({
 
 const updateStaffSchema = createStaffSchema.partial().omit({ email: true });
 
+const linkUserSchema = z.object({
+  userId: z.string().min(1),
+});
+
 staffRouter.get("/me", async (c) => {
   const staffRow = c.get("staff");
   return c.json(staffRow);
@@ -106,6 +110,32 @@ staffRouter.patch("/:id", zValidator("json", updateStaffSchema), async (c) => {
   return c.json(row);
 });
 
+staffRouter.patch("/:id/link-user", zValidator("json", linkUserSchema), async (c) => {
+  const db = getDb();
+  const targetId = c.req.param("id");
+  const body = c.req.valid("json");
+  const currentStaff = c.get("staff");
+
+  if (currentStaff.role !== "manager" && !currentStaff.isSuperUser) {
+    return c.json({ error: "Forbidden: only managers or super users can link staff to users" }, 403);
+  }
+
+  const [existing] = await db
+    .select()
+    .from(staff)
+    .where(eq(staff.id, targetId))
+    .limit(1);
+  if (!existing) return c.json({ error: "Not found" }, 404);
+
+  const [updated] = await db
+    .update(staff)
+    .set({ userId: body.userId, updatedAt: new Date() })
+    .where(eq(staff.id, targetId))
+    .returning();
+
+  return c.json(updated);
+});
+
 staffRouter.delete("/:id", async (c) => {
   const db = getDb();
   const id = c.req.param("id");

apps/api/src/services/reminders.ts

@@ -12,6 +12,7 @@ import {
   services,
   staff,
   reminderLogs,
+  session,
 } from "@groombook/db";
 import {
   buildReminderEmail,
@@ -155,6 +156,19 @@ export function startReminderScheduler(): void {
     runReminderCheck().catch((err) => {
       console.error("[reminders] Error during reminder check:", err);
     });
+    runSessionCleanup().catch((err) => {
+      console.error("[reminders] Error during session cleanup:", err);
+    });
   });
   console.log("[reminders] Reminder scheduler started");
 }
+
+// Deletes expired sessions from the database.
+// Runs every minute alongside reminder checks.
+export async function runSessionCleanup(): Promise<void> {
+  const db = getDb();
+  const now = new Date();
+  await db
+    .delete(session)
+    .where(lt(session.expiresAt, now));
+}

apps/e2e/tests/navigation.spec.ts

@@ -44,7 +44,10 @@ test.beforeEach(async ({ page }) => {
         json: { newClients: [], activeInPeriodCount: 0, churnRisk: [], churnRiskTotal: 0 },
       });
     }
-    // Appointments, clients, services, staff, invoices, book, etc.
+    if (url.includes("/api/invoices")) {
+      return route.fulfill({ json: { data: [], total: 0 } });
+    }
+    // Appointments, clients, services, staff, book, etc.
     return route.fulfill({ json: [] });
   });
 });
@@ -82,6 +85,7 @@ test("admin staff page loads", async ({ page }) => {
 
 test("admin invoices page loads", async ({ page }) => {
   await page.goto("/admin/invoices");
+  await page.waitForLoadState("domcontentloaded");
   await expect(page.getByText("GroomBook")).toBeVisible();
   await expect(page.getByRole("link", { name: "Invoices" })).toBeVisible();
 });

apps/web/package.json

@@ -15,7 +15,7 @@
   "dependencies": {
     "@groombook/types": "workspace:*",
     "@tailwindcss/vite": "^4.2.2",
-    "better-auth": "^1.0.0",
+    "better-auth": "^1.5.6",
     "lucide-react": "^0.577.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",

apps/web/public/demo-pets/dog-basset-brown-white.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96C853FAECD363909C4A0</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-bichon-white-groomed.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96CFC84D7A9333708F278</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-boxer-fawn-athletic.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96D48D7892E37386B9ACB</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-cavalier-cream-gentle.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96C25663D703833F23607</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-cocker-buff-friendly.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96D89851C843332073968</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-dachshund-black-tan.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96C9C5A03D33730C61AD8</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-pomeranian-white-studio.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96BEB91911B30317E3BE8</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-schnauzer-black-groomed.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96BFB7B92D33535D6D90D</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-setter-red-sunlit.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96B8BDF4B473630A2E120</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/public/demo-pets/dog-sheepdog-merle-running.png

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>AccessDenied</Code>
+  <Message>You have no right to access this object because of bucket acl.</Message>
+  <RequestId>69D96D78BFFCAD343037C27C</RequestId>
+  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
+  <EC>0003-00000001</EC>
+  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
+</Error>

apps/web/src/App.tsx

@@ -1,4 +1,4 @@
-import { Routes, Route, Link, useLocation, Navigate } from "react-router-dom";
+import { Routes, Route, Link, useLocation, Navigate, useNavigate } from "react-router-dom";
 import { useEffect, useState } from "react";
 import { AppointmentsPage } from "./pages/Appointments.js";
 import { ClientsPage } from "./pages/Clients.js";
@@ -18,22 +18,31 @@ import { DevLoginSelector, getDevUser } from "./pages/DevLoginSelector.js";
 import { DevSessionIndicator } from "./components/DevSessionIndicator.js";
 import { BrandingProvider, useBranding } from "./BrandingContext.js";
 import { GlobalSearch } from "./components/GlobalSearch.js";
-import { useSession, signIn } from "./lib/auth-client.js";
+import { useSession, signIn, signOut } from "./lib/auth-client.js";
 
 function LoginPage() {
   const [isLoading, setIsLoading] = useState(false);
   const [providers, setProviders] = useState<string[]>([]);
+  const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
     fetch("/api/auth/providers")
       .then((r) => r.json())
       .then((data) => setProviders(data.providers ?? []))
       .catch(() => setProviders([]));
+    const params = new URLSearchParams(window.location.search);
+    const authError = params.get("error");
+    if (authError) setError(authError.replace(/_/g, " "));
   }, []);
 
   const handleSocialLogin = async (provider: string) => {
     setIsLoading(true);
-    await signIn.social({ provider, callbackURL: window.location.origin });
+    setError(null);
+    const result = await signIn.social({ provider, callbackURL: window.location.origin });
+    if (result?.error) {
+      setError(result.error.message ?? "Sign-in failed");
+      setIsLoading(false);
+    }
   };
 
   const isGoogle = providers.includes("google");
@@ -65,6 +74,11 @@ function LoginPage() {
         <p style={{ color: "#6b7280", marginBottom: "1.5rem", fontSize: 14 }}>
           Sign in to continue
         </p>
+        {error && (
+          <div style={{ background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 6, padding: "0.5rem 0.75rem", marginBottom: "1rem", color: "#991b1b", fontSize: 13 }}>
+            {error}
+          </div>
+        )}
         {isGoogle && (
           <button
             onClick={() => handleSocialLogin("google")}
@@ -167,6 +181,7 @@ const NAV_LINKS = [
 
 function AdminLayout() {
   const location = useLocation();
+  const navigate = useNavigate();
   const { branding } = useBranding();
 
   const logoSrc = branding.logoBase64 && branding.logoMimeType
@@ -195,6 +210,7 @@ function AdminLayout() {
           alignItems: "center",
           gap: 8,
           marginRight: "1.25rem",
+          flexShrink: 0,
         }}>
           {logoSrc && (
             <img src={logoSrc} alt="" style={{ width: 24, height: 24, objectFit: "contain" }} />
@@ -208,45 +224,73 @@ function AdminLayout() {
           </strong>
         </div>
         <GlobalSearch />
-        <Link
-          to="/admin/book"
+        <div style={{
+          display: "flex",
+          overflowX: "auto",
+          flex: 1,
+          minWidth: 0,
+          gap: "0.25rem",
+        }}>
+          <Link
+            to="/admin/book"
+            style={{
+              padding: "0.4rem 0.85rem",
+              borderRadius: 6,
+              textDecoration: "none",
+              fontSize: 13,
+              fontWeight: 600,
+              color: "#fff",
+              background: branding.primaryColor,
+              boxShadow: "0 1px 2px rgba(79, 138, 111, 0.3)",
+              flexShrink: 0,
+            }}
+          >
+            Book
+          </Link>
+          {NAV_LINKS.map(({ to, label }) => {
+            const active =
+              to === "/admin"
+                ? location.pathname === "/admin"
+                : location.pathname.startsWith(to);
+            return (
+              <Link
+                key={to}
+                to={to}
+                style={{
+                  padding: "0.4rem 0.75rem",
+                  borderRadius: 6,
+                  textDecoration: "none",
+                  fontSize: 13,
+                  fontWeight: active ? 600 : 500,
+                  color: active ? "#2d6a4f" : "#4b5563",
+                  background: active ? "#ecfdf5" : "transparent",
+                  flexShrink: 0,
+                }}
+              >
+                {label}
+              </Link>
+            );
+          })}
+        </div>
+        <button
+          onClick={async () => {
+            await signOut();
+            navigate("/login");
+          }}
           style={{
+            flexShrink: 0,
             padding: "0.4rem 0.85rem",
             borderRadius: 6,
-            textDecoration: "none",
+            border: "1px solid #e2e8f0",
+            background: "#fff",
+            color: "#4b5563",
             fontSize: 13,
-            fontWeight: 600,
-            color: "#fff",
-            background: branding.primaryColor,
-            marginRight: "0.5rem",
-            boxShadow: "0 1px 2px rgba(79, 138, 111, 0.3)",
+            fontWeight: 500,
+            cursor: "pointer",
           }}
         >
-          Book
-        </Link>
-        {NAV_LINKS.map(({ to, label }) => {
-          const active =
-            to === "/admin"
-              ? location.pathname === "/admin"
-              : location.pathname.startsWith(to);
-          return (
-            <Link
-              key={to}
-              to={to}
-              style={{
-                padding: "0.4rem 0.75rem",
-                borderRadius: 6,
-                textDecoration: "none",
-                fontSize: 13,
-                fontWeight: active ? 600 : 500,
-                color: active ? "#2d6a4f" : "#4b5563",
-                background: active ? "#ecfdf5" : "transparent",
-              }}
-            >
-              {label}
-            </Link>
-          );
-        })}
+          Logout
+        </button>
       </nav>
       <main style={{ padding: "1.25rem 1.5rem" }}>
         <Routes>

apps/web/src/lib/auth-client.ts

@@ -4,4 +4,4 @@ export const authClient = createAuthClient({
   baseURL: import.meta.env.VITE_API_URL ?? "",
 });
 
-export const { signIn, signOut, useSession } = authClient;
+export const { signIn, signOut, useSession, changePassword } = authClient;

apps/web/src/portal/sections/AccountSettings.tsx

@@ -1,6 +1,7 @@
 import React, { useState, useEffect } from "react";
 import { User, Lock, PawPrint, FileCheck, Plus, Archive } from "lucide-react";
 import { PetForm } from "./PetForm.js";
+import { authClient } from "../../lib/auth-client.js";
 
 interface Props {
   sessionId: string | null;
@@ -148,9 +149,11 @@ function PasswordChange({ readOnly }: { readOnly: boolean }) {
   const [newPassword, setNewPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
   const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState(false);
+  const [loading, setLoading] = useState(false);
 
   const passwordsMatch = newPassword === confirmPassword;
-  const canSubmit = currentPassword.length > 0 && newPassword.length > 0 && passwordsMatch;
+  const canSubmit = newPassword.length > 0 && passwordsMatch && !loading;
 
   if (readOnly) {
     return (
@@ -160,17 +163,34 @@ function PasswordChange({ readOnly }: { readOnly: boolean }) {
     );
   }
 
-  function handleSubmit() {
+  async function handleSubmit() {
     if (!canSubmit) return;
     if (newPassword !== confirmPassword) {
       setError("Passwords do not match.");
       return;
     }
-    // TODO: Wire up to actual password-change API endpoint once backend support exists
     setError(null);
-    setCurrentPassword("");
-    setNewPassword("");
-    setConfirmPassword("");
+    setLoading(true);
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const result = await (authClient as any).changePassword({
+        currentPassword,
+        newPassword,
+      });
+      if (result.error) {
+        setError(result.error.message ?? "Failed to change password.");
+      } else {
+        setSuccess(true);
+        setCurrentPassword("");
+        setNewPassword("");
+        setConfirmPassword("");
+        setTimeout(() => setSuccess(false), 4000);
+      }
+    } catch {
+      setError("An unexpected error occurred.");
+    } finally {
+      setLoading(false);
+    }
   }
 
   return (
@@ -205,12 +225,13 @@ function PasswordChange({ readOnly }: { readOnly: boolean }) {
           />
         </div>
         {error && <p className="text-sm text-red-500">{error}</p>}
+        {success && <p className="text-sm text-green-600">Password updated successfully.</p>}
         <button
           onClick={handleSubmit}
           disabled={!canSubmit}
           className="px-4 py-2 bg-(--color-accent) text-white rounded-lg text-sm font-medium hover:bg-(--color-accent-hover) disabled:opacity-50 disabled:cursor-not-allowed"
         >
-          Update Password
+          {loading ? "Updating..." : "Update Password"}
         </button>
       </div>
     </div>

apps/web/vite.config.ts

@@ -41,11 +41,11 @@ export default defineConfig({
       workbox: {
         globPatterns: ["**/*.{js,css,html,ico,png,svg,woff2}"],
         navigateFallbackDenylist: [
-          /^\/api\/auth\/oauth2\/callback\//,
+          /^\/api\/auth\//,
         ],
         runtimeCaching: [
           {
-            urlPattern: /^http.*\/api\/.*/i,
+            urlPattern: /^http.*\/api\/(?!auth\/).*/i,
             handler: "NetworkFirst",
             options: {
               cacheName: "api-cache",

generate_dogs_bulk.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+import base64
+import requests
+import os
+import json
+import time
+from datetime import datetime
+
+api_key = os.environ.get("MINIMAX_API_KEY")
+if not api_key:
+    raise ValueError("MINIMAX_API_KEY environment variable not set")
+
+url = "https://api.minimax.io/v1/image_generation"
+headers = {"Authorization": f"Bearer {api_key}"}
+
+os.makedirs("minimax-output", exist_ok=True)
+
+# Comprehensive list of dog breeds and variations for diverse demo data
+dog_prompts = [
+    # Large breeds
+    ("german-shepherd-alert", "German Shepherd dog with alert expression, standing confidently, professional pet photography, studio lighting, photorealistic"),
+    ("golden-retriever-happy", "Golden Retriever with joyful expression, sitting, golden coat, natural daylight, professional pet photography, photorealistic"),
+    ("labrador-running", "Black Labrador Retriever running towards camera, outdoor park setting, dynamic pose, professional pet photography, photorealistic"),
+    ("german-shepherd-sitting", "German Shepherd sitting in front of studio backdrop, professional portrait, studio lighting, photorealistic"),
+    ("golden-retriever-lying", "Golden Retriever lying down on grass, peaceful expression, outdoor natural lighting, professional pet photography, photorealistic"),
+
+    # Medium breeds
+    ("beagle-curious", "Beagle with curious expression, sitting, outdoor garden setting, professional pet photography, photorealistic"),
+    ("cocker-spaniel-groomed", "Cocker Spaniel freshly groomed with fluffy coat, happy expression, professional grooming studio, photorealistic"),
+    ("english-springer-spaniel", "English Springer Spaniel in natural outdoor setting, alert pose, professional pet photography, photorealistic"),
+    ("boxer-playful", "Boxer dog with playful expression, standing, muscular build, professional studio lighting, photorealistic"),
+    ("bulldog-gentle", "English Bulldog with gentle expression, sitting, studio backdrop, professional pet photography, photorealistic"),
+
+    # Small breeds
+    ("maltese-fluffy", "Maltese dog with white fluffy coat, sitting, groomed appearance, professional pet photography, studio lighting, photorealistic"),
+    ("shih-tzu-groomed", "Shih Tzu with long groomed coat, sitting pretty, professional grooming studio, photorealistic"),
+    ("pomeranian-alert", "Pomeranian with alert expression, standing, fluffy coat, professional pet photography, photorealistic"),
+    ("yorkshire-terrier", "Yorkshire Terrier with silky coat, sitting, professional grooming environment, photorealistic"),
+    ("pug-curious", "Pug with curious expression, sitting, studio lighting, professional pet photography, photorealistic"),
+
+    # Specialty breeds
+    ("poodle-standard-groomed", "Standard Poodle with professionally groomed coat, standing in show stance, professional grooming studio, photorealistic"),
+    ("dachshund-long", "Long-haired Dachshund, lying down, relaxed pose, professional pet photography, photorealistic"),
+    ("corgi-happy", "Welsh Corgi with happy expression, standing, professional outdoor setting, photorealistic"),
+    ("husky-alert", "Siberian Husky with alert expression, sitting, professional pet photography, studio lighting, photorealistic"),
+    ("german-shepherd-lying", "German Shepherd lying down in relaxed pose, indoor setting, professional pet photography, photorealistic"),
+
+    # Mixed/rescue variations
+    ("mixed-breed-brown", "Brown and white mixed breed dog, friendly expression, sitting, professional pet photography, photorealistic"),
+    ("mixed-breed-black", "Black mixed breed dog with gentle eyes, standing, outdoor natural lighting, photorealistic"),
+    ("mixed-breed-spotted", "Spotted mixed breed dog, playful pose, outdoor park setting, professional pet photography, photorealistic"),
+    ("terrier-mix-sitting", "Terrier mix dog, alert expression, sitting, professional studio backdrop, photorealistic"),
+    ("spaniel-mix-outdoor", "Spaniel mix dog in outdoor garden, relaxed pose, natural daylight, professional pet photography, photorealistic"),
+
+    # Additional variations
+    ("labrador-golden", "Golden Labrador Retriever, calm expression, standing in professional pose, studio lighting, photorealistic"),
+    ("labrador-black-sitting", "Black Labrador Retriever sitting, gentle expression, professional pet photography, photorealistic"),
+    ("rottweiler-calm", "Rottweiler with calm expression, sitting, professional studio, photorealistic"),
+    ("doberman-alert", "Doberman Pinscher with alert expression, standing, professional pet photography, photorealistic"),
+    ("german-shepherd-side", "German Shepherd in side profile, standing, professional outdoor setting, photorealistic"),
+]
+
+print(f"Generating {len(dog_prompts)} unique dog images...")
+print(f"Start time: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+print("")
+
+generated = 0
+failed = 0
+
+for i, (filename_base, prompt) in enumerate(dog_prompts, 1):
+    filename = f"dog-{filename_base}.png"
+    filepath = f"minimax-output/{filename}"
+
+    # Check if already exists
+    if os.path.exists(filepath):
+        size = os.path.getsize(filepath)
+        print(f"[{i:2d}/{len(dog_prompts)}] ✓ {filename} (already exists, {size} bytes)")
+        generated += 1
+        continue
+
+    print(f"[{i:2d}/{len(dog_prompts)}] Generating {filename}...", end=" ", flush=True)
+
+    payload = {
+        "model": "image-01",
+        "prompt": prompt,
+        "aspect_ratio": "1:1",
+        "response_format": "base64",
+    }
+
+    try:
+        response = requests.post(url, headers=headers, json=payload, timeout=120)
+
+        # Check for quota errors
+        if response.status_code == 429:
+            print(f"✗ QUOTA EXCEEDED")
+            print(f"\nQuota limit reached after {generated} successful generations")
+            break
+
+        response.raise_for_status()
+
+        data = response.json()
+        if "data" in data and "image_base64" in data["data"]:
+            images = data["data"]["image_base64"]
+
+            with open(filepath, "wb") as f:
+                f.write(base64.b64decode(images[0]))
+
+            file_size = os.path.getsize(filepath)
+            print(f"✓ ({file_size} bytes)")
+            generated += 1
+        else:
+            print(f"✗ Unexpected response format")
+            failed += 1
+
+    except requests.exceptions.Timeout:
+        print(f"✗ Timeout")
+        failed += 1
+    except requests.exceptions.RequestException as e:
+        if "429" in str(e) or "quota" in str(e).lower():
+            print(f"✗ QUOTA EXCEEDED")
+            print(f"\nQuota limit reached after {generated} successful generations")
+            break
+        else:
+            print(f"✗ {type(e).__name__}")
+            failed += 1
+    except Exception as e:
+        print(f"✗ {type(e).__name__}")
+        failed += 1
+
+    time.sleep(0.5)  # Small delay between requests
+
+print("")
+print(f"End time: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+print(f"✓ Successfully generated: {generated}")
+print(f"✗ Failed: {failed}")
+print(f"\nCopying images to demo-pets directory...")
+
+# Copy all generated images to demo-pets
+import subprocess
+result = subprocess.run(
+    ["cp", "-v", "minimax-output/dog-*.png", "apps/web/public/demo-pets/"],
+    capture_output=True,
+    text=True
+)
+
+if result.returncode == 0:
+    # Count files in demo-pets
+    import glob
+    demo_pets = glob.glob("apps/web/public/demo-pets/dog-*.png")
+    print(f"✓ Copied to demo-pets. Total dog images: {len(demo_pets)}")
+else:
+    print(f"Note: Copy result - {result.stderr}")

packages/db/src/seed.ts

@@ -184,7 +184,7 @@ const dogBreeds = [
   "Brittany", "English Springer Spaniel", "Maltese", "Bichon Frise",
   "West Highland White Terrier", "Vizsla", "Chihuahua", "Collie",
   "Basset Hound", "Newfoundland", "Samoyed", "Australian Shepherd",
-  "Pembroke Welsh Corgi", "French Bulldog", "Weimaraner",
+  "Pembroke Welsh Corgi", "French Bulldog", "Weimaraner", "Puggle",
   "Mixed Breed", "Mixed Breed", "Mixed Breed",
 ];
 
@@ -281,6 +281,44 @@ const productsUsed = [
   "Coconut oil shampoo, leave-in conditioner, cologne",
 ];
 
+const demoPetImages = [
+  "/demo-pets/dog-golden-after.png",
+  "/demo-pets/dog-poodle-groomed.png",
+  "/demo-pets/dog-black-lab.png",
+  "/demo-pets/dog-shih-tzu.png",
+  "/demo-pets/dog-cocker-spaniel.png",
+  "/demo-pets/dog-schnauzer.png",
+  "/demo-pets/dog-maltese.png",
+  "/demo-pets/dog-dachshund.png",
+  "/demo-pets/dog-pomeranian.png",
+  "/demo-pets/dog-bichon-frise.png",
+  "/demo-pets/dog-golden-retriever.png",
+  "/demo-pets/dog-labrador.png",
+  "/demo-pets/dog-mixed-breed.png",
+  "/demo-pets/dog-poodle.png",
+  "/demo-pets/dog-terrier.png",
+  "/demo-pets/dog-afghan-hound.png",
+  "/demo-pets/dog-basset-brown-white.png",
+  "/demo-pets/dog-bichon-white-groomed.png",
+  "/demo-pets/dog-boxer-fawn-athletic.png",
+  "/demo-pets/dog-cavalier-cream-gentle.png",
+  "/demo-pets/dog-cocker-buff-friendly.png",
+  "/demo-pets/dog-corgi.png",
+  "/demo-pets/dog-dachshund-black-tan.png",
+  "/demo-pets/dog-golden-before.png",
+  "/demo-pets/dog-pomeranian-white-studio.png",
+  "/demo-pets/dog-schnauzer-black-groomed.png",
+  "/demo-pets/dog-setter-red-sunlit.png",
+  "/demo-pets/dog-sheepdog-merle-running.png",
+];
+
+const puggleImages = [
+  "/demo-pets/dog-puggle-fawn-playful.png",
+  "/demo-pets/dog-puggle-black-sitting.png",
+  "/demo-pets/dog-puggle-cream-groomed.png",
+  "/demo-pets/dog-puggle-fawn-grooming.png",
+];
+
 // ── Service definitions ──────────────────────────────────────────────────────
 // Deterministic service IDs + UNIQUE(name) constraint make seed fully idempotent:
 // first run inserts, subsequent runs update existing rows via ON CONFLICT (name).
@@ -621,6 +659,7 @@ async function seed() {
   const clientRecords: ClientRecord[] = [];
   const petRecords: PetRecord[] = [];
 
+  let petIndex = 0; // Track pet count to assign Puggle images to first 250 pets
   const clientBatchSize = 50;
   for (let batch = 0; batch < Math.ceil(cfg.clientCount / clientBatchSize); batch++) {
     const clientBatch: (typeof schema.clients.$inferInsert)[] = [];
@@ -652,7 +691,7 @@ async function seed() {
       const petCount = rand() < 0.5 ? 1 : rand() < 0.7 ? 2 : 3;
       for (let p = 0; p < petCount; p++) {
         const petId = uuid();
-        const breed = pick(dogBreeds);
+        const breed = petIndex < 250 ? "Puggle" : pick(dogBreeds);
         const dob = new Date(now);
         dob.setFullYear(dob.getFullYear() - randInt(1, 14));
         dob.setMonth(randInt(0, 11));
@@ -671,9 +710,11 @@ async function seed() {
           shampooPreference: pick(shampoos),
           specialCareNotes: rand() < 0.1 ? "Vet clearance required before grooming" : null,
           customFields: {},
+          image: petIndex < 250 ? pick(puggleImages) : pick(demoPetImages),
         });
 
         petRecords.push({ id: petId, clientId });
+        petIndex++;
       }
     }
 
@@ -704,6 +745,7 @@ async function seed() {
             shampooPreference: pet.shampooPreference,
             specialCareNotes: pet.specialCareNotes,
             customFields: pet.customFields,
+            image: pet.image,
           },
         });
     }
@@ -738,8 +780,8 @@ async function seed() {
       .values({ id: uc.id, name: uc.name, email: uc.email, phone: uc.phone, address: uc.address })
       .onConflictDoUpdate({ target: schema.clients.id, set: { name: uc.name, email: uc.email, phone: uc.phone, address: uc.address } });
     await db.insert(schema.pets)
-      .values({ id: uc.petId, clientId: uc.id, name: uc.petName, species: "Dog", breed: uc.petBreed, weightKg: "25.00", dateOfBirth: new Date("2021-03-15T00:00:00Z") })
-      .onConflictDoUpdate({ target: schema.pets.id, set: { clientId: uc.id, name: uc.petName, species: "Dog", breed: uc.petBreed, weightKg: "25.00", dateOfBirth: new Date("2021-03-15T00:00:00Z") } });
+      .values({ id: uc.petId, clientId: uc.id, name: uc.petName, species: "Dog", breed: uc.petBreed, weightKg: "25.00", dateOfBirth: new Date("2021-03-15T00:00:00Z"), image: pick(demoPetImages) })
+      .onConflictDoUpdate({ target: schema.pets.id, set: { clientId: uc.id, name: uc.petName, species: "Dog", breed: uc.petBreed, weightKg: "25.00", dateOfBirth: new Date("2021-03-15T00:00:00Z"), image: pick(demoPetImages) } });
     // Create one completed appointment for this client
     const apptId = uuid();
     const svcIdx = 0;

pnpm-lock.yaml

@@ -87,7 +87,7 @@ importers:
         specifier: ^4.2.2
         version: 4.2.2(vite@6.4.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.32.0)(terser@5.46.1)(tsx@4.21.0))
       better-auth:
-        specifier: ^1.0.0
+        specifier: ^1.5.6
         version: 1.5.6(@opentelemetry/api@1.9.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(vitest@3.2.4(@types/node@22.19.15)(jiti@2.6.1)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.46.1)(tsx@4.21.0))
       lucide-react:
         specifier: ^0.577.0