Merge branch 'main' into GRO-574-rate-limit-migration

Better Auth rate_limit table migration exists on branch but hasn't
been deployed to UAT. Switching to memory storage bypasses the
missing table entirely, restoring auth functionality immediately.

Memory storage is per-instance (not shared) — rate limiting still
functions but won't be distributed across pods. This is acceptable
for UAT while the migration is being promoted through the pipeline.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/lib/auth.ts

@@ -95,7 +95,7 @@ export async function initAuth(): Promise<void> {
           enabled: true,
           max: 10,
           window: 60,
-          storage: "database",
+          storage: "memory",
         },
         plugins: [
           genericOAuth({
@@ -234,7 +234,7 @@ export async function initAuth(): Promise<void> {
         enabled: true,
         max: 10,
         window: 60,
-        storage: "database",
+        storage: "memory",
       },
       account: {
         storeStateStrategy: "cookie" as const,

apps/api/src/routes/setup.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { eq, getDb, staff, businessSettings, authProviderConfig, encryptSecret } from "@groombook/db";
+import { and, eq, getDb, sql, staff, businessSettings, authProviderConfig, encryptSecret } from "@groombook/db";
 import type { AppEnv } from "../middleware/rbac.js";
 
 export const setupRouter = new Hono<AppEnv>();
@@ -108,6 +108,21 @@ setupRouter.post("/", zValidator("json", setupSchema), async (c) => {
       }
     }
 
+    if (!resolvedStaff && jwt.email) {
+      // Try auto-link by email: staff record exists with matching email but no userId
+      const [byEmail] = await tx
+        .select()
+        .from(staff)
+        .where(and(eq(staff.email, jwt.email), sql`${staff.userId} IS NULL`));
+      if (byEmail) {
+        await tx
+          .update(staff)
+          .set({ userId: jwt.sub })
+          .where(eq(staff.id, byEmail.id));
+        resolvedStaff = { ...byEmail, userId: jwt.sub };
+      }
+    }
+
     if (!resolvedStaff) {
       // Brand new user during OOBE — create staff record
       if (!jwt.email) {

packages/db/migrations/0025_rate_limit.sql

@@ -0,0 +1,6 @@
+-- Better-Auth rate limiting table (GRO-574)
+CREATE TABLE "rate_limit" (
+  key TEXT NOT NULL PRIMARY KEY,
+  count INTEGER NOT NULL,
+  last_request BIGINT NOT NULL
+);

packages/db/migrations/meta/_journal.json

@@ -176,6 +176,13 @@
       "when": 1775396067192,
       "tag": "0024_invoice_indexes",
       "breakpoints": true
+    },
+    {
+      "idx": 25,
+      "version": "7",
+      "when": 1775482467192,
+      "tag": "0025_rate_limit",
+      "breakpoints": true
     }
   ]
 }