fix(GRO-693): add UAT Terraform infrastructure with correct GitRepository

- Add terraform workspace at apps/overlays/uat/terraform/ (backend.tf, main.tf, variables.tf, users.tf, imports.tf, terraform.tfvars) - Add Terraform CRD (authentik-terraform.yaml) with correct path ./apps/overlays/uat/terraform relative to groombook/app repo root - Add GitRepository CRD (gitrepository-groombook.yaml) pointing to groombook/app at fix/gro-844-network-policy branch (NOT groombook/infra which no longer exists) - Add kustomization.yaml to tie it together Root cause: the GitRepository was pointing to https://github.com/groombook/infra which no longer exists, and the terraform files were not committed to the current repository at the correct path. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-21 19:55:35 +00:00
28 changed files with 774 additions and 462 deletions
@@ -1,54 +0,0 @@
-name: Release Helm Chart
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'charts/**'
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout groombook
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Checkout groombook.dev (Helm chart host)
-        uses: actions/checkout@v4
-        with:
-          repository: groombook/groombook.dev
-          path: gitea-pages
-          token: ${{ gitea.token }}
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-
-      - name: Update Helm dependencies
-        run: helm dependency update charts/groombook
-
-      - name: Package chart
-        run: |
-          mkdir -p gitea-pages/charts
-          helm package charts/groombook -d gitea-pages/charts
-
-      - name: Update repo index
-        run: |
-          # TODO: update URL once Gitea Pages hosting is confirmed
-          CHART_URL="${HELM_CHART_URL:-https://groombook.farh.net/charts}"
-          if [ -f gitea-pages/charts/index.yaml ]; then
-            helm repo index gitea-pages/charts --merge gitea-pages/charts/index.yaml --url "$CHART_URL"
-          else
-            helm repo index gitea-pages/charts --url "$CHART_URL"
-          fi
-
-      - name: Push to groombook.dev
-        run: |
-          cd gitea-pages
-          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
-          git add charts/
-          git diff --staged --quiet && echo 'No chart changes' && exit 0
-          git commit -m "Update Helm chart repository"
-          git push
@@ -127,12 +127,18 @@ jobs:
    needs: [build, e2e]
    outputs:
      tag: ${{ steps.version.outputs.tag }}
+    permissions:
+      contents: read
+      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Generate image tag
        id: version
        run: |
+          # Always include short SHA so each build is immutable and cache-from can never
+          # cross-contaminate between commits. For PRs the format is pr-N-sha7; for main
+          # it is YYYY.MM.DD-sha7.
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            TAG="pr-${{ github.event.pull_request.number }}-${GITHUB_SHA::7}"
          else
@@ -144,12 +150,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

-      - name: Log in to Gitea Container Registry
+      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
-          registry: git.farh.net
-          username: ${{ gitea.actor }}
-          password: ${{ gitea.token }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@v6
@@ -159,10 +165,10 @@ jobs:
          target: runner
          push: true
          tags: |
-            git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:api
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:api,mode=max
+            ghcr.io/groombook/api:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/api:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Migrate image
        uses: docker/build-push-action@v6
@@ -172,10 +178,10 @@ jobs:
          target: migrate
          push: true
          tags: |
-            git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:migrate
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:migrate,mode=max
+            ghcr.io/groombook/migrate:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/migrate:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Seed image
        uses: docker/build-push-action@v6
@@ -185,10 +191,10 @@ jobs:
          target: seed
          push: true
          tags: |
-            git.farh.net/groombook/seed:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:seed
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:seed,mode=max
+            ghcr.io/groombook/seed:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/seed:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Reset image
        uses: docker/build-push-action@v6
@@ -198,10 +204,10 @@ jobs:
          target: reset
          push: true
          tags: |
-            git.farh.net/groombook/reset:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:reset
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:reset,mode=max
+            ghcr.io/groombook/reset:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/reset:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Web image
        uses: docker/build-push-action@v6
@@ -210,16 +216,19 @@ jobs:
          file: apps/web/Dockerfile
          push: true
          tags: |
-            git.farh.net/groombook/web:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/web:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:web
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:web,mode=max
+            ghcr.io/groombook/web:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/web:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

  deploy-dev:
    name: Deploy PR to groombook-dev
-    runs-on: ubuntu-latest
+    runs-on: runners-groombook
    needs: [docker]
    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
    steps:
      - name: Install kubectl
        run: |
@@ -236,6 +245,7 @@ jobs:
          TAG="pr-$PR_NUM-${SHA::7}"
          echo "Deploying images tagged $TAG to groombook-dev..."

+          # Run migration with PR image
          kubectl delete job "migrate-pr-$PR_NUM" -n groombook-dev --ignore-not-found
          cat <<EOF | kubectl apply -n groombook-dev -f -
          apiVersion: batch/v1
@@ -250,7 +260,7 @@ jobs:
                restartPolicy: Never
                containers:
                - name: migrate
-                  image: git.farh.net/groombook/migrate:$TAG
+                  image: ghcr.io/groombook/migrate:$TAG
                  env:
                  - name: DATABASE_URL
                    valueFrom:
@@ -261,25 +271,35 @@ jobs:
          kubectl wait --for=condition=complete "job/migrate-pr-$PR_NUM" \
            -n groombook-dev --timeout=120s

-          kubectl set image deployment/api api=git.farh.net/groombook/api:$TAG -n groombook-dev
-          kubectl set image deployment/web web=git.farh.net/groombook/web:$TAG -n groombook-dev
+          # Update deployments
+          kubectl set image deployment/api api=ghcr.io/groombook/api:$TAG -n groombook-dev
+          kubectl set image deployment/web web=ghcr.io/groombook/web:$TAG -n groombook-dev

+          # Wait for rollout
          kubectl rollout status deployment/api -n groombook-dev --timeout=300s
          kubectl rollout status deployment/web -n groombook-dev --timeout=300s

          echo "Deployment complete."

      - name: Comment on PR
-        env:
-          PR_NUM: ${{ github.event.pull_request.number }}
-          GITEA_TOKEN: ${{ gitea.token }}
-        run: |
-          TAG="pr-${PR_NUM}"
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/app/issues/$PR_NUM/comments" \
-            -d "{\"body\": \"## Deployed to groombook-dev\n\n**Images:** \`${TAG}\`\n**URL:** https://dev.groombook.farh.net\n\nReady for UAT validation.\"}"
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.issue.number;
+            const tag = `pr-${pr}`;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr,
+              body: [
+                '## Deployed to groombook-dev',
+                '',
+                `**Images:** \`${tag}\``,
+                '**URL:** https://dev.groombook.farh.net',
+                '',
+                'Ready for UAT validation.'
+              ].join('\n')
+            });

  web-e2e:
    name: Web E2E (Dev)
@@ -320,13 +340,21 @@ jobs:
    name: Update Infra Image Tags
    runs-on: ubuntu-latest
    needs: [docker]
-    if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') && github.event_name == 'push'
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+      pull-requests: write
    steps:
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Clone groombook/infra
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
        run: |
-          git clone https://oauth2:$GITEA_TOKEN@git.farh.net/groombook/infra.git /tmp/infra
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra

      - name: Install yq
        run: |
@@ -343,25 +371,30 @@ jobs:
          fi
          export SHORT_SHA="${SHA::7}"
          echo "Updating dev overlay image tags to: $TAG"
+          echo "Updating migration/seed Job names with SHA: $SHORT_SHA"
          cd /tmp/infra
          DEV_KUST="apps/groombook/overlays/dev/kustomization.yaml"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/api")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/web")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"

+          # Update migrate Job name to include short SHA (immutable template fix)
          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
          if [ -f "$MIGRATE_JOB" ]; then
            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
+            # Ensure ttlSecondsAfterFinished is set for automatic cleanup
            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$MIGRATE_JOB"
          fi

+          # Update seed Job name to include short SHA (immutable template fix)
          SEED_JOB="apps/groombook/base/seed-job.yaml"
          if [ -f "$SEED_JOB" ]; then
            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
+            # Ensure ttlSecondsAfterFinished is set for automatic cleanup
            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$SEED_JOB"
          fi

@@ -370,40 +403,32 @@ jobs:
      - name: Create PR on groombook/infra
        env:
          TAG: ${{ needs.docker.outputs.tag }}
-          GITEA_TOKEN: ${{ gitea.token }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
        run: |
          if [ -z "$TAG" ]; then
            TAG="$(date -u +%Y.%m.%d)-${GITHUB_SHA::7}"
          fi
+
          cd /tmp/infra
          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
          git checkout -b "chore/update-image-tags-${TAG}"
          git add apps/groombook/overlays/dev/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
          git commit -m "chore: update image tags and migration/seed Job names to ${TAG}"
+
          git push -u origin "chore/update-image-tags-${TAG}"

-          EXISTING_PR=$(curl -s \
-            -H "Authorization: token $GITEA_TOKEN" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls?state=open&limit=50" \
-            | jq -r ".[] | select(.head.label == \"chore/update-image-tags-${TAG}\") | .number" | head -1)
+          # Check if PR already exists for this branch
+          EXISTING_PR=$(gh pr list --repo groombook/infra --head "chore/update-image-tags-${TAG}" --state open --json number -q '.[0].number' || true)
          if [ -n "$EXISTING_PR" ]; then
-            echo "PR #$EXISTING_PR already exists, merging"
-            curl -s -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "https://git.farh.net/api/v1/repos/groombook/infra/pulls/$EXISTING_PR/merge" \
-              -d '{"Do":"merge"}'
+            echo "PR #$EXISTING_PR already exists for this tag, merging existing PR"
+            gh pr merge "$EXISTING_PR" --repo groombook/infra --merge
          else
-            PR_NUM=$(curl -s -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "https://git.farh.net/api/v1/repos/groombook/infra/pulls" \
-              -d "{\"head\":\"chore/update-image-tags-${TAG}\",\"base\":\"main\",\"title\":\"chore: deploy ${TAG} to dev\",\"body\":\"[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge\"}" \
-              | jq '.number')
-            curl -s -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "https://git.farh.net/api/v1/repos/groombook/infra/pulls/$PR_NUM/merge" \
-              -d '{"Do":"merge"}'
+            PR_URL=$(gh pr create \
+              --repo groombook/infra \
+              --base main \
+              --head "chore/update-image-tags-${TAG}" \
+              --title "chore: deploy ${TAG} to dev" \
+              --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
+            gh pr merge "$PR_URL" --merge
          fi
@@ -0,0 +1,54 @@
+name: Release Helm Chart
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'charts/**'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout groombook
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Checkout groombook.github.io
+        uses: actions/checkout@v4
+        with:
+          repository: groombook/groombook.github.io
+          path: gh-pages
+          token: ${{ secrets.CHART_REPO_TOKEN }}
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+
+      - name: Update Helm dependencies
+        run: helm dependency update charts/groombook
+
+      - name: Package chart
+        run: |
+          mkdir -p gh-pages/charts
+          helm package charts/groombook -d gh-pages/charts
+
+      - name: Update repo index
+        run: |
+          if [ -f gh-pages/charts/index.yaml ]; then
+            helm repo index gh-pages/charts --merge gh-pages/charts/index.yaml --url https://groombook.github.io/charts
+          else
+            helm repo index gh-pages/charts --url https://groombook.github.io/charts
+          fi
+
+      - name: Push to groombook.github.io
+        run: |
+          cd gh-pages
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add charts/
+          git diff --staged --quiet && echo 'No chart changes' && exit 0
+          git commit -m "Update Helm chart repository"
+          git push
@@ -12,6 +12,9 @@ jobs:
  promote:
    name: Promote to Production
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
    steps:
      - name: Validate tag format
        run: |
@@ -22,25 +25,28 @@ jobs:
          fi
          echo "Tag format valid: $TAG"

-      - name: Verify image exists in Gitea Container Registry
+      - name: Verify image exists in GHCR
        env:
-          GITEA_TOKEN: ${{ gitea.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ inputs.tag }}"
-          if ! curl -sf \
-            -H "Authorization: token $GITEA_TOKEN" \
-            "https://git.farh.net/api/v1/packages/groombook?type=container&limit=50" \
-            | jq -e --arg t "$TAG" '[.[] | select(.name == "api" and .version == $t)] | length > 0' > /dev/null 2>&1; then
-            echo "::warning::Could not verify git.farh.net/groombook/api:$TAG via package API — verify manually if needed."
-          else
-            echo "Image verified: git.farh.net/groombook/api:$TAG exists"
+          # Check that the API image exists — if API was pushed, web/migrate were too
+          if ! gh api "/orgs/groombook/packages/container/api/versions" --jq ".[].metadata.container.tags[]" 2>/dev/null | grep -qF "$TAG"; then
+            echo "::error::Image ghcr.io/groombook/api:$TAG not found in GHCR. Verify the tag was built and pushed."
+            exit 1
          fi
+          echo "Image verified: ghcr.io/groombook/api:$TAG exists"
+
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Clone groombook/infra
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
        run: |
-          git clone https://oauth2:$GITEA_TOKEN@git.farh.net/groombook/infra.git /tmp/infra
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra

      - name: Install yq
        run: |
@@ -58,17 +64,19 @@ jobs:
          export SHORT_SHA
          export TAG

-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/api")).newTag = env(TAG)' "$PROD_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/web")).newTag = env(TAG)' "$PROD_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/migrate")).newTag = env(TAG)' "$PROD_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/seed")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$PROD_KUST"

+          # Update migrate Job name to include short SHA (immutable template fix)
          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
          if [ -f "$MIGRATE_JOB" ]; then
            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
          fi

+          # Update seed Job name to include short SHA (immutable template fix)
          SEED_JOB="apps/groombook/base/seed-job.yaml"
          if [ -f "$SEED_JOB" ]; then
            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
@@ -80,29 +88,30 @@ jobs:
      - name: Create PR on groombook/infra
        env:
          TAG: ${{ inputs.tag }}
-          GITEA_TOKEN: ${{ gitea.token }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
        run: |
          cd /tmp/infra
          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
          git checkout -b "release/promote-prod-${TAG}"
          git add apps/groombook/overlays/prod/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
          git commit -m "release: promote ${TAG} to production"
          git push -u origin "release/promote-prod-${TAG}"
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls" \
-            -d "{\"head\":\"release/promote-prod-${TAG}\",\"base\":\"main\",\"title\":\"release: promote ${TAG} to production\",\"body\":\"Promote image tag ${TAG} to production after UAT sign-off. cc @cpfarhood\"}"
+          gh pr create \
+            --repo groombook/infra \
+            --base main \
+            --head "release/promote-prod-${TAG}" \
+            --title "release: promote ${TAG} to production" \
+            --body "Promote image tag ${TAG} to production after UAT sign-off. cc @cpfarhood"

      - name: Notify on failure
        if: failure()
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/app/issues/$RUN_ID/comments" \
-            -d '{"body": "## Production Promotion Failed\n\nThe `promote-prod` workflow failed. Check the workflow run logs for details."}'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: '## Production Promotion Failed\n\nThe `promote-prod` workflow failed. Check the workflow run logs for details.'
+            });
@@ -12,12 +12,20 @@ jobs:
  promote-to-uat:
    name: Promote to groombook-uat
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
    steps:
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Clone groombook/infra
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
        run: |
-          git clone https://oauth2:$GITEA_TOKEN@git.farh.net/groombook/infra.git /tmp/infra
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra

      - name: Install yq
        run: |
@@ -41,17 +49,21 @@ jobs:
          export SHORT_SHA
          export TAG

-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/api")).newTag = env(TAG)' "$UAT_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/web")).newTag = env(TAG)' "$UAT_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/migrate")).newTag = env(TAG)' "$UAT_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/seed")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$UAT_KUST"

+          # Update migrate Job name to include short SHA (immutable template fix)
          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
          if [ -f "$MIGRATE_JOB" ]; then
            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
          fi

+          # Update seed Job name to include short SHA (immutable template fix)
+          # NOTE: Do NOT update the image tag here — let the Kustomize images transformer
+          # in the UAT overlay handle it via newTag. This avoids the immutable template issue.
          SEED_JOB="apps/groombook/base/seed-job.yaml"
          if [ -f "$SEED_JOB" ]; then
            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
@@ -63,36 +75,34 @@ jobs:
      - name: Create PR on groombook/infra
        env:
          TAG: ${{ inputs.image_tag }}
-          GITEA_TOKEN: ${{ gitea.token }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
        run: |
          cd /tmp/infra
          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
          git checkout -b "chore/update-uat-image-tags-${TAG}"
          git add apps/groombook/overlays/uat/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
          git commit -m "chore: promote ${TAG} to UAT"
+
          git push -u origin "chore/update-uat-image-tags-${TAG}"

-          PR_NUM=$(curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls" \
-            -d "{\"head\":\"chore/update-uat-image-tags-${TAG}\",\"base\":\"main\",\"title\":\"chore: promote ${TAG} to UAT\",\"body\":\"[GRO-429](/GRO/issues/GRO-429) — UAT promotion triggered by CTO\"}" \
-            | jq '.number')
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls/$PR_NUM/merge" \
-            -d '{"Do":"merge"}'
+          # Create PR and merge immediately (no required checks on groombook/infra)
+          PR_URL=$(gh pr create \
+            --repo groombook/infra \
+            --base main \
+            --head "chore/update-uat-image-tags-${TAG}" \
+            --title "chore: promote ${TAG} to UAT" \
+            --body "[GRO-429](/GRO/issues/GRO-429) — UAT promotion triggered by CTO")
+          gh pr merge "$PR_URL" --merge

      - name: Notify on failure
        if: failure()
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/app/issues/$RUN_ID/comments" \
-            -d '{"body": "## UAT Promotion Failed\n\nThe `promote-to-uat` workflow failed. Check the workflow run logs for details.\n\nCommon issues:\n- UAT overlay not found (ensure GRO-427 is complete)\n- GITEA_TOKEN permissions"}'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: '## UAT Promotion Failed\n\nThe `promote-to-uat` workflow failed. Check the workflow run logs for details.\n\nCommon issues:\n- UAT overlay not found (ensure GRO-427 is complete)\n- Infra repo access token expired'
+            });
@@ -19,7 +19,7 @@ import { impersonationRouter } from "./routes/impersonation.js";
 import { settingsRouter } from "./routes/settings.js";
 import { authProviderRouter } from "./routes/authProvider.js";
 import { searchRouter } from "./routes/search.js";
-import { getObject } from "./lib/s3.js";
+import { getPresignedGetUrl } from "./lib/s3.js";
 import { calendarRouter } from "./routes/calendar.js";
 import { setupRouter } from "./routes/setup.js";
 import { getDb, businessSettings, eq, staff } from "@groombook/db";
@@ -126,31 +126,20 @@ function validateLogoMagicBytes(
  }
 }

-// Public logo proxy — no auth required, streams logo from S3 so browser never sees raw S3 URL
-app.get("/api/branding/logo", async (c) => {
-  const db = getDb();
-  const [row] = await db.select().from(businessSettings).limit(1);
-  if (!row) return c.json({ error: "Settings not found" }, 404);
-  if (!row.logoKey) return c.json({ error: "No logo on file" }, 404);
-
-  const { body, contentType } = await getObject(row.logoKey);
-  return new Response(Buffer.from(body), {
-    status: 200,
-    headers: {
-      "Content-Type": contentType,
-      "Cache-Control": "public, max-age=86400",
-    },
-  });
-});
-
 // Public branding endpoint — no auth required, returns business name/colors/logo
 app.get("/api/branding", async (c) => {
  const db = getDb();
  const [row] = await db.select().from(businessSettings).limit(1);
  const settings = row ?? { businessName: "GroomBook", primaryColor: "#4f8a6f", accentColor: "#8b7355", logoBase64: null, logoMimeType: null, logoKey: null };

-  // Return the public proxy path so browser never sees a raw S3 URL
-  const logoUrl = settings.logoKey ? "/api/branding/logo" : null;
+  let logoUrl: string | null = null;
+  if (settings.logoKey) {
+    try {
+      logoUrl = await getPresignedGetUrl(settings.logoKey);
+    } catch {
+      // If S3 URL generation fails, fall back to legacy base64
+    }
+  }

  // Defensive: validate magic bytes to prevent MIME type confusion attacks
  // via the legacy base64 logo fields
@@ -68,25 +68,6 @@ export async function deleteObject(key: string): Promise<void> {
  );
 }

-/** Read an object from S3 and return its body buffer and content type. */
-export async function getObject(key: string): Promise<{ body: Buffer; contentType: string }> {
-  const client = getS3Client();
-  const response = await client.send(
-    new GetObjectCommand({
-      Bucket: getBucket(),
-      Key: key,
-    })
-  );
-  const chunks: Uint8Array[] = [];
-  // response.Body is a Readable stream; collect chunks into a buffer
-  for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {
-    chunks.push(chunk);
-  }
-  const body = Buffer.concat(chunks);
-  const contentType = response.ContentType ?? "application/octet-stream";
-  return { body, contentType };
-}
-
 /** Upload an object directly to S3 (server-side only, not a pre-signed URL). */
 export async function putObject(
  key: string,
@@ -101,8 +101,6 @@ invoicesRouter.get(
        paymentMethod: invoices.paymentMethod,
        paidAt: invoices.paidAt,
        notes: invoices.notes,
-        stripePaymentIntentId: invoices.stripePaymentIntentId,
-        stripeRefundId: invoices.stripeRefundId,
        createdAt: invoices.createdAt,
        updatedAt: invoices.updatedAt,
      })
@@ -130,17 +128,7 @@ invoicesRouter.get("/:id", async (c) => {
    db.select().from(invoiceTipSplits).where(eq(invoiceTipSplits.invoiceId, id)),
  ]);

-  let cardLast4: string | null = null;
-  let paymentStatus: string | null = null;
-  if (invoice.stripePaymentIntentId) {
-    const details = await getPaymentIntentDetails(invoice.stripePaymentIntentId);
-    if (details) {
-      cardLast4 = details.cardLast4;
-      paymentStatus = details.paymentStatus;
-    }
-  }
-
-  return c.json({ ...invoice, lineItems, tipSplits, cardLast4, paymentStatus });
+  return c.json({ ...invoice, lineItems, tipSplits });
 });

 // Save tip splits for an invoice (replaces existing splits)
@@ -460,6 +448,9 @@ invoicesRouter.post(
    if (invoice.status !== "paid") {
      return c.json({ error: "Refund only allowed on paid invoices" }, 422);
    }
+    if (!invoice.stripePaymentIntentId) {
+      return c.json({ error: "No Stripe payment intent found for this invoice" }, 422);
+    }

    return await db.transaction(async (tx) => {
      if (body.idempotencyKey) {
@@ -472,75 +463,57 @@ invoicesRouter.post(
        }
      }

-      let refundId: string;
-
-      if (invoice.stripePaymentIntentId) {
-        const result = await processRefund(id, body.amountCents);
-        if (!result) return c.json({ error: "Refund failed" }, 500);
-        refundId = result.refundId;
-      } else {
-        // Manual refund — no Stripe call needed
-        refundId = `manual_${id}_${Date.now()}`;
-      }
+      const result = await processRefund(id, body.amountCents);
+      if (!result) return c.json({ error: "Refund failed" }, 500);

      await tx.insert(refunds).values({
        invoiceId: id,
-        stripeRefundId: refundId,
+        stripeRefundId: result.refundId,
        idempotencyKey: body.idempotencyKey ?? null,
        amountCents: body.amountCents ?? null,
      });

-      return c.json({ refundId });
+      return c.json({ refundId: result.refundId });
    });
  }
 );

 // Payment stats for admin dashboard
 invoicesRouter.get("/stats/summary", async (c) => {
-  try {
-    const db = getDb();
-    const now = new Date();
-    const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+  const db = getDb();
+  const now = new Date();
+  const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);

-    const [revenueResult] = await db
-      .select({ total: sql<number>`coalesce(sum(total_cents), 0)` })
-      .from(invoices)
-      .where(and(eq(invoices.status, "paid"), sql`${invoices.paidAt} >= ${startOfMonth}`));
+  const [revenueResult] = await db
+    .select({ total: sql<number>`coalesce(sum(total_cents), 0)` })
+    .from(invoices)
+    .where(and(eq(invoices.status, "paid"), sql`${invoices.paidAt} >= ${startOfMonth}`));

-    const [outstandingResult] = await db
-      .select({ total: sql<number>`coalesce(sum(total_cents), 0)` })
-      .from(invoices)
-      .where(eq(invoices.status, "pending"));
+  const [outstandingResult] = await db
+    .select({ total: sql<number>`coalesce(sum(total_cents), 0)` })
+    .from(invoices)
+    .where(eq(invoices.status, "pending"));

-    const [refundsResult] = await db
-      .select({ total: sql<number>`coalesce(sum(amount_cents), 0)` })
-      .from(refunds)
-      .where(sql`${refunds.createdAt} >= ${startOfMonth}`);
+  const [refundsResult] = await db
+    .select({ total: sql<number>`coalesce(sum(amount_cents), 0)` })
+    .from(refunds)
+    .where(sql`${refunds.createdAt} >= ${startOfMonth}`);

-    const methodBreakdown = await db
-      .select({
-        method: invoices.paymentMethod,
-        total: sql<number>`count(*)`,
-      })
-      .from(invoices)
-      .where(and(eq(invoices.status, "paid"), sql`${invoices.paidAt} >= ${startOfMonth}`))
-      .groupBy(invoices.paymentMethod);
+  const methodBreakdown = await db
+    .select({
+      method: invoices.paymentMethod,
+      total: sql<number>`count(*)`,
+    })
+    .from(invoices)
+    .where(and(eq(invoices.status, "paid"), sql`${invoices.paidAt} >= ${startOfMonth}`))
+    .groupBy(invoices.paymentMethod);

-    return c.json({
-      revenueThisMonth: revenueResult?.total ?? 0,
-      outstanding: outstandingResult?.total ?? 0,
-      refundsThisMonth: refundsResult?.total ?? 0,
-      methodBreakdown,
-    });
-  } catch (err) {
-    console.error("stats/summary error:", err);
-    return c.json({
-      revenueThisMonth: 0,
-      outstanding: 0,
-      refundsThisMonth: 0,
-      methodBreakdown: [],
-    });
-  }
+  return c.json({
+    revenueThisMonth: revenueResult?.total ?? 0,
+    outstanding: outstandingResult?.total ?? 0,
+    refundsThisMonth: refundsResult?.total ?? 0,
+    methodBreakdown,
+  });
 });

 // Get Stripe payment details for an invoice (card last4, payment status, refund status)
@@ -2,7 +2,7 @@ import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
 import { eq, getDb, businessSettings } from "@groombook/db";
-import { getPresignedUploadUrl, deleteObject, putObject, getObject } from "../lib/s3.js";
+import { getPresignedUploadUrl, getPresignedGetUrl, deleteObject, putObject } from "../lib/s3.js";
 import { requireSuperUser } from "../middleware/rbac.js";

 export const settingsRouter = new Hono();
@@ -215,8 +215,7 @@ settingsRouter.post(

 /**
 * GET /api/admin/settings/logo
- * Proxies the logo from S3 so the browser never sees an S3 URL.
- * Returns the image bytes with proper Content-Type.
+ * Returns a presigned GET URL for the logo.
 */
 settingsRouter.get("/logo", async (c) => {
  const db = getDb();
@@ -225,14 +224,8 @@ settingsRouter.get("/logo", async (c) => {
  if (!row) return c.json({ error: "Settings not found" }, 404);
  if (!row.logoKey) return c.json({ error: "No logo on file" }, 404);

-  const { body, contentType } = await getObject(row.logoKey);
-  return new Response(Buffer.from(body), {
-    status: 200,
-    headers: {
-      "Content-Type": contentType,
-      "Cache-Control": "public, max-age=86400",
-    },
-  });
+  const url = await getPresignedGetUrl(row.logoKey);
+  return c.json({ url, logoKey: row.logoKey });
 });

 /**
@@ -44,16 +44,6 @@ test.beforeEach(async ({ page }) => {
        json: { newClients: [], activeInPeriodCount: 0, churnRisk: [], churnRiskTotal: 0 },
      });
    }
-    if (url.includes("/api/invoices/stats/summary")) {
-      return route.fulfill({
-        json: {
-          revenueThisMonth: 0,
-          outstanding: 0,
-          refundsThisMonth: 0,
-          methodBreakdown: [],
-        },
-      });
-    }
    if (url.includes("/api/invoices")) {
      return route.fulfill({ json: { data: [], total: 0 } });
    }
@@ -0,0 +1,53 @@
+# =============================================================================
+# Terraform CRD for Flux ToFu Controller — Authentik groombook-uat
+# =============================================================================
+# This CRD tells the Flux ToFu Controller to reconcile the Terraform
+# workspace at apps/overlays/uat/terraform/
+#
+# The ToFu Controller will:
+# 1. Clone the groombook/app GitRepository
+# 2. Run tofu init + tofu plan/apply in the specified path
+# 3. Store Terraform state in a Kubernetes secret (backend.tf)
+# 4. Inject TF_VAR_authentik_token from the authentik-credentials secret
+#    via tf-controller varsFrom (maps secret key to Terraform variable)
+#
+# ApiVersion: infra.contrib.fluxcd.io/v1alpha2 (tf-controller)
+# =============================================================================
+
+apiVersion: infra.contrib.fluxcd.io/v1alpha2
+kind: Terraform
+metadata:
+  name: authentik-uat
+  namespace: groombook-uat
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/part-of: groombook
+    app.kubernetes.io/env: uat
+spec:
+  # Reconcile every hour
+  interval: 1h
+
+  # Path within the GitRepository (groombook/app)
+  path: ./apps/overlays/uat/terraform
+
+  # Source reference — must match the GitRepository name watching this repo
+  sourceRef:
+    kind: GitRepository
+    name: groombook
+
+  # Auto-approve plans (no manual intervention needed for infrastructure)
+  approvePlan: "auto"
+
+  # Clean up Terraform resources when this CRD is deleted
+  destroyResourcesOnDeletion: true
+
+  # Inject TF_VAR_authentik_token from the sealed secret via tf-controller varsFrom
+  # (maps secret key "authentik_token" to Terraform var.authentik_token)
+  varsFrom:
+    - kind: Secret
+      name: authentik-credentials
+    - kind: Secret
+      name: authentik-uat-users-credentials
+
+  runnerPodTemplate:
+    spec: {}
@@ -0,0 +1,19 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: groombook
+  namespace: groombook-uat
+  labels:
+    app.kubernetes.io/name: groombook
+    app.kubernetes.io/part-of: groombook
+    app.kubernetes.io/env: uat
+spec:
+  interval: 15m
+  provider: github
+  ref:
+    branch: fix/gro-844-network-policy
+  secretRef:
+    name: cpfarhood-k8s
+  timeout: 60s
+  url: https://github.com/groombook/app
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: groombook-uat
+resources:
+  - gitrepository-groombook.yaml
+  - authentik-terraform.yaml
@@ -0,0 +1,21 @@
+# =============================================================================
+# Backend configuration for Terraform state
+# =============================================================================
+# Uses Kubernetes backend with tf-controller managed state secret.
+# tf-controller creates a Kubernetes Secret named:
+#   tfstate-<name>-<secret_suffix>
+# i.e. tfstate-authentik-uat-authentik-uat-tf-state
+# in the namespace specified by the Terraform CRD metadata.namespace (groombook-uat).
+#
+# Valid Kubernetes backend attributes for tf-controller:
+#   secret_suffix, namespace, config_path, cluster_ca_cert, client_certificate,
+#   client_key, token, exec, host, insecure, username, password,
+#   in_cluster, load_config, config_paths
+# =============================================================================
+
+terraform {
+  backend "kubernetes" {
+    secret_suffix = "authentik-uat-tf-state"
+    namespace     = "groombook-uat"
+  }
+}
@@ -0,0 +1,12 @@
+# Import existing Authentik resources into Terraform state.
+# These blocks are consumed on the first apply and become no-ops thereafter.
+
+import {
+  to = authentik_oauth2_provider.groombook-uat
+  id = "284"
+}
+
+import {
+  to = authentik_application.groombook-uat
+  id = "e77a9c45-bed6-4a23-bc62-178f166f099e"
+}
@@ -0,0 +1,99 @@
+# =============================================================================
+# Terraform configuration for Authentik groombook-uat application
+# =============================================================================
+# This Terraform workspace manages the Authentik OAuth2 application and provider
+# for the groombook-uat environment.
+#
+# The authentik_token used for authentication is sourced from the
+# `authentik-credentials` SealedSecret (injected as TF_VAR_authentik_token
+# by the Terraform CRD runnerPodTemplate.spec.varsFrom).
+#
+# To import existing resources (run via tf-controller exec or locally with
+# AUTHENTIK_TOKEN set):
+#   tofu import authentik_oauth2_provider.groombook-uat pk-284
+#   tofu import authentik_application.groombook-uat e77a9c45-bed6-4a23-bc62-178f166f099e
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Provider configuration
+# -----------------------------------------------------------------------------
+terraform {
+  required_providers {
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "~> 2024.12"
+    }
+  }
+}
+
+provider "authentik" {
+  url       = var.authentik_url
+  api_token = var.authentik_token
+  tls_verify = true
+}
+
+# -----------------------------------------------------------------------------
+# OAuth2 Provider for groombook-uat
+# pk = 284 (existing — imported, not recreated)
+# -----------------------------------------------------------------------------
+resource "authentik_oauth2_provider" "groombook-uat" {
+  name        = "groombook-uat-provider"
+  slug        = "groombook-uat"
+  client_id   = "" # managed by imported resource; tracked via ignore_changes
+  client_secret = "" # managed by imported resource; tracked via ignore_changes
+  client_type = "confidential"
+  redirect_uris = ["https://uat.groombook.dev/api/auth/oauth2/callback/authentik"]
+  signing_key = "authentik signing key"
+
+  # Keep Terraform from overwriting the client_id, client_secret, and signing_key
+  # which are managed by the imported existing resource
+  lifecycle {
+    ignore_changes = [
+      client_id,
+      client_secret,
+      signing_key,
+    ]
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Application for groombook-uat
+# pk = e77a9c45-bed6-4a23-bc62-178f166f099e (existing — imported, not recreated)
+# -----------------------------------------------------------------------------
+resource "authentik_application" "groombook-uat" {
+  name        = "groombook-uat"
+  slug        = "groombook-uat"
+  group       = "groombook"
+  policy_ids  = []
+  description = "GroomBook UAT application"
+
+  # Link to the OAuth2 provider
+  oauth2_provider = authentik_oauth2_provider.groombook-uat.id
+
+  # Track name, slug, group, and oauth2_provider for drift detection;
+  # ignore policy_ids and description which may be updated out-of-band
+  lifecycle {
+    ignore_changes = [
+      policy_ids,
+      description,
+    ]
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Outputs (for reference / verification)
+# -----------------------------------------------------------------------------
+output "oauth2_provider_pk" {
+  description = "Authentik OAuth2 Provider primary key"
+  value       = authentik_oauth2_provider.groombook-uat.pk
+}
+
+output "application_pk" {
+  description = "Authentik Application primary key"
+  value       = authentik_application.groombook-uat.pk
+}
+
+output "application_slug" {
+  description = "Authentik Application slug"
+  value       = authentik_application.groombook-uat.slug
+}
@@ -0,0 +1,10 @@
+# =============================================================================
+# Terraform variable values for groombook-uat
+# =============================================================================
+# NOTE: authentik_token should be provided via AUTHENTIK_TOKEN env var,
+# sourced from the authentik-credentials SealedSecret.
+# The placeholder value here is not used when running via tf-controller.
+# =============================================================================
+
+authentik_url = "https://auth.farh.net"
+# authentik_token = "<set via AUTHENTIK_TOKEN env var from authentik-credentials secret>"
@@ -0,0 +1,121 @@
+# =============================================================================
+# Authentik UAT user personas — Terraform resources
+# =============================================================================
+# Creates three Authentik users bound to the groombook-uat application:
+#   - UAT Super User   (manager role, superuser)
+#   - UAT Groomer      (staff/groomer role)
+#   - UAT Customer     (no staff record — auth identity only)
+#
+# Passwords are sourced from sensitive Terraform variables which are injected
+# via tf-controller varsFrom from the authentik-uat-users-credentials SealedSecret.
+#
+# User PKs are exported as outputs — these are the OIDC sub claims in Authentik.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Group: groombook-uat-users
+# -----------------------------------------------------------------------------
+resource "authentik_group" "groombook-uat-users" {
+  name = "groombook-uat-users"
+}
+
+# -----------------------------------------------------------------------------
+# User: UAT Super User
+# -----------------------------------------------------------------------------
+resource "authentik_user" "uat-super" {
+  name            = "UAT Super User"
+  username        = "uat-super"
+  email           = "uat-super@groombook.dev"
+  password        = var.uat_super_password
+  active          = true
+  # Attributes stored as JSON string per authentik_user schema
+  attributes_json = jsonencode({
+    role = "manager"
+  })
+}
+
+# Add uat-super to the group
+resource "authentik_group_membership" "uat-super" {
+  group = authentik_group.groombook-uat-users.id
+  user  = authentik_user.uat-super.pk
+}
+
+# Bind the group to the groombook-uat application via policy binding
+# This grants group members authentication access to the application
+resource "authentik_policy_binding" "uat-super-group-binding" {
+  policy     = authentik_group.groombook-uat-users.id
+  target     = authentik_application.groombook-uat.pk
+  binding_type = "group_whitelist"
+}
+
+# -----------------------------------------------------------------------------
+# User: UAT Groomer (Staff)
+# -----------------------------------------------------------------------------
+resource "authentik_user" "uat-groomer" {
+  name            = "UAT Groomer"
+  username        = "uat-groomer"
+  email           = "uat-groomer@groombook.dev"
+  password        = var.uat_groomer_password
+  active          = true
+  attributes_json = jsonencode({
+    role = "groomer"
+  })
+}
+
+# Add uat-groomer to the group
+resource "authentik_group_membership" "uat-groomer" {
+  group = authentik_group.groombook-uat-users.id
+  user  = authentik_user.uat-groomer.pk
+}
+
+# Bind the group to the groombook-uat application
+resource "authentik_policy_binding" "uat-groomer-group-binding" {
+  policy     = authentik_group.groombook-uat-users.id
+  target     = authentik_application.groombook-uat.pk
+  binding_type = "group_whitelist"
+}
+
+# -----------------------------------------------------------------------------
+# User: UAT Customer
+# -----------------------------------------------------------------------------
+resource "authentik_user" "uat-customer" {
+  name            = "UAT Customer"
+  username        = "uat-customer"
+  email           = "uat-customer@groombook.dev"
+  password        = var.uat_customer_password
+  active          = true
+  attributes_json = jsonencode({
+    role = "customer"
+  })
+}
+
+# Add uat-customer to the group
+resource "authentik_group_membership" "uat-customer" {
+  group = authentik_group.groombook-uat-users.id
+  user  = authentik_user.uat-customer.pk
+}
+
+# Bind the group to the groombook-uat application
+resource "authentik_policy_binding" "uat-customer-group-binding" {
+  policy     = authentik_group.groombook-uat-users.id
+  target     = authentik_application.groombook-uat.pk
+  binding_type = "group_whitelist"
+}
+
+# -----------------------------------------------------------------------------
+# Outputs — OIDC sub claims (= user PK in Authentik)
+# -----------------------------------------------------------------------------
+output "uat_super_user_pk" {
+  description = "UAT Super User primary key (OIDC sub)"
+  value       = authentik_user.uat-super.pk
+}
+
+output "uat_groomer_user_pk" {
+  description = "UAT Groomer primary key (OIDC sub)"
+  value       = authentik_user.uat-groomer.pk
+}
+
+output "uat_customer_user_pk" {
+  description = "UAT Customer primary key (OIDC sub)"
+  value       = authentik_user.uat-customer.pk
+}
@@ -0,0 +1,33 @@
+# =============================================================================
+# Variables for Authentik groombook-uat Terraform workspace
+# =============================================================================
+
+variable "authentik_url" {
+  description = "Base URL of the Authentik instance"
+  type        = string
+  default     = "https://auth.farh.net"
+}
+
+variable "authentik_token" {
+  description = "API token for Authentik (from authentik-credentials secret via AUTHENTIK_TOKEN env var)"
+  type        = string
+  sensitive   = true
+}
+
+variable "uat_super_password" {
+  description = "Password for the UAT Super User account"
+  type        = string
+  sensitive   = true
+}
+
+variable "uat_groomer_password" {
+  description = "Password for the UAT Groomer staff account"
+  type        = string
+  sensitive   = true
+}
+
+variable "uat_customer_password" {
+  description = "Password for the UAT Customer account"
+  type        = string
+  sensitive   = true
+}
@@ -112,17 +112,9 @@ export function AppointmentsPage() {
  const [viewMode, setViewMode] = useState<"status" | "groomer">("status");
  // null key = unassigned; staffId string = that groomer; undefined set = all visible
  const [hiddenGroomers, setHiddenGroomers] = useState<Set<string | null>>(new Set());
-  const [paymentStats, setPaymentStats] = useState<{ revenueThisMonth: number; outstanding: number; refundsThisMonth: number; methodBreakdown: { method: string | null; total: number }[] } | null>(null);

  const weekEnd = addDays(weekStart, 6);

-  useEffect(() => {
-    fetch("/api/invoices/stats/summary")
-      .then((r) => r.ok ? r.json() : null)
-      .then((data) => { if (data) setPaymentStats(data); })
-      .catch(() => {});
-  }, []);
-
  const loadAppointments = useCallback(() => {
    const from = weekStart.toISOString();
    const to = addDays(weekStart, 7).toISOString();
@@ -322,24 +314,6 @@ export function AppointmentsPage() {
        </button>
      </div>

-      {/* Payment Stats Summary */}
-      {paymentStats && (
-        <div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fit, minmax(160px, 1fr))", gap: "0.75rem", marginBottom: "1.25rem" }}>
-          <div style={{ background: "#f0fdf4", border: "1px solid #bbf7d0", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#166534", fontWeight: 600, marginBottom: "0.25rem" }}>Revenue (paid)</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#15803d" }}>${(paymentStats.revenueThisMonth / 100).toFixed(2)}</div>
-          </div>
-          <div style={{ background: "#fefce8", border: "1px solid #fde047", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#854d0e", fontWeight: 600, marginBottom: "0.25rem" }}>Outstanding</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#a16207" }}>${(paymentStats.outstanding / 100).toFixed(2)}</div>
-          </div>
-          <div style={{ background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#991b1b", fontWeight: 600, marginBottom: "0.25rem" }}>Refunds (this mo.)</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#dc2626" }}>${(paymentStats.refundsThisMonth / 100).toFixed(2)}</div>
-          </div>
-        </div>
-      )}
-
      {/* ── View Mode + Groomer Filters ── */}
      <div style={{ display: "flex", alignItems: "center", gap: "0.5rem", marginBottom: "0.75rem", flexWrap: "wrap" }}>
        <span style={{ fontSize: 13, fontWeight: 600, color: "#374151" }}>Color by:</span>
@@ -173,21 +173,22 @@ function InvoiceDetailModal({
  const [error, setError] = useState<string | null>(null);
  const [tipStr, setTipStr] = useState((invoice.tipCents / 100).toFixed(2));
  const [paymentMethod, setPaymentMethod] = useState<string>(invoice.paymentMethod ?? "cash");
-const [showRefundDialog, setShowRefundDialog] = useState(false);
+  const [showRefundDialog, setShowRefundDialog] = useState(false);
  const [refundType, setRefundType] = useState<"full" | "partial">("full");
-  const [refundAmount, setRefundAmount] = useState("");
-  const [refundError, setRefundError] = useState<string | null>(null);
-  const [refunding, setRefunding] = useState(false);
+  const [partialAmount, setPartialAmount] = useState("");
+  const [stripeDetails, setStripeDetails] = useState<{ cardLast4: string | null; paymentStatus: string | null; stripeRefundId: string | null } | null>(null);

-  // Fetch current staff role to determine manager access
-  const [staffMe, setStaffMe] = useState<{ role: string; isSuperUser: boolean } | null>(null);
+  // Fetch Stripe details when modal opens for paid invoices with a payment intent
  useEffect(() => {
-    fetch("/api/staff/me")
-      .then((r) => r.json())
-      .then((d) => setStaffMe(d))
-      .catch(() => setStaffMe(null));
-  }, []);
-  const isManager = staffMe && (staffMe.role === "manager" || staffMe.isSuperUser);
+    if (invoice.status === "paid" && invoice.stripePaymentIntentId) {
+      fetch(`/api/invoices/${invoice.id}/stripe-details`)
+        .then((r) => r.ok ? r.json() : null)
+        .then((data) => { if (data) setStripeDetails(data); })
+        .catch(() => {});
+    } else {
+      setStripeDetails(null);
+    }
+  }, [invoice.id, invoice.status, invoice.stripePaymentIntentId]);

  // Tip split state: array of {staffId, staffName, pct}
  const linkedAppt = invoice.appointmentId
@@ -291,6 +292,35 @@ const [showRefundDialog, setShowRefundDialog] = useState(false);
    }
  }

+  async function issueRefund() {
+    const amountCents = refundType === "partial"
+      ? Math.round(parseFloat(partialAmount) * 100)
+      : undefined;
+    if (refundType === "partial" && (!amountCents || amountCents <= 0)) {
+      setError("Enter a valid refund amount");
+      return;
+    }
+    setSaving(true);
+    setError(null);
+    try {
+      const res = await fetch(`/api/invoices/${invoice.id}/refund`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(amountCents ? { amountCents } : {}),
+      });
+      if (!res.ok) {
+        const err = (await res.json()) as { error?: string };
+        throw new Error(err.error ?? `HTTP ${res.status}`);
+      }
+      setShowRefundDialog(false);
+      onUpdated();
+    } catch (e: unknown) {
+      setError(e instanceof Error ? e.message : "Failed to issue refund");
+    } finally {
+      setSaving(false);
+    }
+  }
+
  if (loading) return <Modal onClose={onClose}><p style={{ padding: "1rem" }}>Loading…</p></Modal>;

  const tipCentsCalc = Math.round(parseFloat(tipStr) * 100) || 0;
@@ -350,15 +380,15 @@ const [showRefundDialog, setShowRefundDialog] = useState(false);
        />
        {invoice.paidAt && <SummaryRow label="Paid on" value={fmtDate(invoice.paidAt)} />}
        {invoice.paymentMethod && <SummaryRow label="Payment" value={invoice.paymentMethod} />}
-        {invoice.stripePaymentIntentId && (
+        {stripeDetails && (
          <>
-            {invoice.cardLast4 && (
-              <SummaryRow label="Card" value={`•••• ${invoice.cardLast4}`} />
+            {stripeDetails.cardLast4 && (
+              <SummaryRow label="Card" value={`•••• ${stripeDetails.cardLast4}`} />
            )}
-            {invoice.paymentStatus && (
-              <SummaryRow label="Stripe status" value={invoice.paymentStatus} />
+            {stripeDetails.paymentStatus && (
+              <SummaryRow label="Stripe status" value={stripeDetails.paymentStatus} />
            )}
-            {invoice.stripeRefundId && (
+            {stripeDetails.stripeRefundId && (
              <SummaryRow label="Refund" value="Refunded" />
            )}
          </>
@@ -480,92 +510,77 @@ const [showRefundDialog, setShowRefundDialog] = useState(false);
        </div>
      )}
      {(invoice.status === "paid" || invoice.status === "void") && (
-        <div style={{ marginTop: "1rem", borderTop: "1px solid #e2e8f0", paddingTop: "1rem" }}>
-          {invoice.stripeRefundId && (
-            <div style={{ marginBottom: "0.75rem", display: "flex", alignItems: "center", gap: "0.5rem" }}>
-              <span style={{ background: "#fef3c7", color: "#92400e", padding: "0.2rem 0.6rem", borderRadius: 4, fontSize: 13, fontWeight: 600 }}>Refunded</span>
-            </div>
+        <div style={{ marginTop: "1rem", display: "flex", justifyContent: "flex-end", gap: "0.5rem" }}>
+          {invoice.status === "paid" && invoice.stripePaymentIntentId && (
+            <button
+              onClick={() => setShowRefundDialog(true)}
+              style={{ ...btnStyle, color: "#b45309", borderColor: "#b45309" }}
+            >
+              Refund
+            </button>
          )}
-          <div style={{ display: "flex", gap: "0.5rem", justifyContent: "flex-end" }}>
-            {invoice.status === "paid" && !invoice.stripeRefundId && isManager && (
-              <button onClick={() => setShowRefundDialog(true)} style={{ ...btnStyle, color: "#fff", backgroundColor: "#7c3aed", borderColor: "#7c3aed" }}>
-                Refund
-              </button>
-            )}
-            <button onClick={onClose} style={btnStyle}>Close</button>
-          </div>
+          <button onClick={onClose} style={btnStyle}>Close</button>
        </div>
      )}

+      {/* Refund Dialog */}
      {showRefundDialog && (
-        <div style={{ marginTop: "1rem", border: "1px solid #e2e8f0", borderRadius: 8, padding: "1rem", background: "#f9fafb" }}>
-          <p style={{ fontWeight: 600, margin: "0 0 0.75rem" }}>Process Refund</p>
-          <div style={{ display: "flex", gap: "0.75rem", marginBottom: "0.75rem" }}>
-            <label style={{ display: "flex", alignItems: "center", gap: "0.25rem", cursor: "pointer" }}>
-              <input type="radio" checked={refundType === "full"} onChange={() => setRefundType("full")} />
+        <Modal onClose={() => setShowRefundDialog(false)}>
+          <h2 style={{ marginTop: 0 }}>Issue Refund</h2>
+          <p style={{ fontSize: 14, color: "#6b7280", marginBottom: "1rem" }}>
+            Invoice total: <strong>{fmtMoney(invoice.totalCents)}</strong>
+          </p>
+          <div style={{ marginBottom: "0.75rem" }}>
+            <label style={{ display: "flex", alignItems: "center", gap: "0.5rem", fontWeight: 600, marginBottom: "0.5rem" }}>
+              <input
+                type="radio"
+                name="refundType"
+                value="full"
+                checked={refundType === "full"}
+                onChange={() => setRefundType("full")}
+              />
              Full refund
            </label>
-            <label style={{ display: "flex", alignItems: "center", gap: "0.25rem", cursor: "pointer" }}>
-              <input type="radio" checked={refundType === "partial"} onChange={() => setRefundType("partial")} />
+            <label style={{ display: "flex", alignItems: "center", gap: "0.5rem", fontWeight: 600 }}>
+              <input
+                type="radio"
+                name="refundType"
+                value="partial"
+                checked={refundType === "partial"}
+                onChange={() => setRefundType("partial")}
+              />
              Partial refund
            </label>
          </div>
          {refundType === "partial" && (
-            <div style={{ marginBottom: "0.75rem" }}>
+            <div style={{ marginBottom: "1rem" }}>
              <input
                type="number"
                min="0.01"
                step="0.01"
-                placeholder="Amount ($)"
-                value={refundAmount}
-                onChange={(e) => setRefundAmount(e.target.value)}
-                style={{ ...inputStyle, width: 100 }}
+                placeholder="0.00"
+                value={partialAmount}
+                onChange={(e) => setPartialAmount(e.target.value)}
+                style={{ ...inputStyle, width: 120 }}
              />
            </div>
          )}
-          {refundError && <p style={{ color: "red", margin: "0 0 0.5rem", fontSize: 13 }}>{refundError}</p>}
-          <div style={{ display: "flex", gap: "0.5rem" }}>
+          {error && <p style={{ color: "red", margin: "0.5rem 0" }}>{error}</p>}
+          <div style={{ display: "flex", gap: "0.5rem", marginTop: "0.75rem" }}>
            <button
-              onClick={async () => {
-                setRefunding(true);
-                setRefundError(null);
-                try {
-                  if (refundType === "partial") {
-                    const parsed = parseFloat(refundAmount);
-                    if (isNaN(parsed) || parsed <= 0) {
-                      setRefundError("Please enter a valid amount greater than zero.");
-                      setRefunding(false);
-                      return;
-                    }
-                  }
-                  const body = refundType === "partial" ? { amountCents: Math.round(parseFloat(refundAmount) * 100) } : {};
-                  const res = await fetch(`/api/invoices/${invoice.id}/refund`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify(body),
-                  });
-                  if (!res.ok) {
-                    const err = (await res.json()) as { error?: string };
-                    throw new Error(err.error ?? `HTTP ${res.status}`);
-                  }
-                  setShowRefundDialog(false);
-                  onUpdated();
-                } catch (e: unknown) {
-                  setRefundError(e instanceof Error ? e.message : "Refund failed");
-                } finally {
-                  setRefunding(false);
-                }
-              }}
-              disabled={refunding}
-              style={{ ...btnStyle, color: "#fff", backgroundColor: "#7c3aed", borderColor: "#7c3aed" }}
+              onClick={issueRefund}
+              disabled={saving}
+              style={{ ...btnStyle, backgroundColor: "#b45309", color: "#fff", borderColor: "#b45309" }}
            >
-              {refunding ? "Processing…" : "Process Refund"}
+              {saving ? "Processing…" : "Issue Refund"}
+            </button>
+            <button onClick={() => setShowRefundDialog(false)} style={btnStyle}>
+              Cancel
            </button>
-            <button onClick={() => { setShowRefundDialog(false); setRefundError(null); }} style={btnStyle}>Cancel</button>
          </div>
-        </div>
+        </Modal>
      )}
-      </Modal>
+    </Modal>
  );
 }

@@ -89,14 +89,24 @@ export function SettingsPage() {
    fetch("/api/admin/settings")
      .then((r) => r.json())
      .then(async (data) => {
-        // The logo is now proxied through the API server so the browser
-        // never receives an S3 URL — use the proxy path directly as the src.
+        let logoUrl: string | null = null;
+        if (data.logoKey) {
+          try {
+            const logoRes = await fetch("/api/admin/settings/logo");
+            if (logoRes.ok) {
+              const logoData = await logoRes.json();
+              logoUrl = logoData.url;
+            }
+          } catch {
+            // ignore
+          }
+        }
        setForm({
          businessName: data.businessName ?? "GroomBook",
          primaryColor: data.primaryColor ?? "#4f8a6f",
          accentColor: data.accentColor ?? "#8b7355",
          logoKey: data.logoKey ?? null,
-          logoUrl: data.logoKey ? "/api/admin/settings/logo" : null,
+          logoUrl,
          logoBase64: data.logoBase64 ?? null,
          logoMimeType: data.logoMimeType ?? null,
        });
@@ -162,7 +172,15 @@ export function SettingsPage() {
        throw new Error(err?.error ?? "Failed to upload logo");
      }
      const { logoKey } = await uploadRes.json();
-      setForm((f) => ({ ...f, logoKey, logoUrl: `/api/admin/settings/logo?t=${Date.now()}`, logoBase64: null, logoMimeType: null }));
+
+      // Fetch the presigned GET URL for display
+      const logoRes = await fetch("/api/admin/settings/logo");
+      if (logoRes.ok) {
+        const logoData = await logoRes.json();
+        setForm((f) => ({ ...f, logoKey, logoUrl: logoData.url, logoBase64: null, logoMimeType: null }));
+      } else {
+        setForm((f) => ({ ...f, logoKey, logoUrl: null, logoBase64: null, logoMimeType: null }));
+      }
      setMessage({ type: "success", text: "Logo uploaded." });
      refresh();
    } catch (err: unknown) {
@@ -326,7 +326,7 @@ export function CustomerPortal() {
        )}

        {/* Main Content */}
-        <main className="flex-1 min-h-screen overflow-hidden">
+        <main className="flex-1 min-h-screen overflow-x-hidden">
          <div className="hidden md:flex items-center justify-between px-8 py-4 border-b border-stone-200 bg-white">
            <div>
              <h1 className="text-lg font-semibold text-stone-800">
@@ -130,7 +130,7 @@ function BillingPaymentsInner({ sessionId, readOnly }: BillingPaymentsProps) {
        </div>
      )}

-      <div className="flex gap-2 flex-wrap overflow-x-auto">
+      <div className="flex gap-2 flex-wrap">
        {([
          { id: "invoices" as const, label: "Invoices", icon: DollarSign },
          { id: "payment" as const, label: "Payment Methods", icon: CreditCard },
@@ -119,10 +119,3 @@ uri
 database-url
 {{- end -}}
 {{- end }}
-
-{{/*
-Auth secret name — always use groombook-auth (sealed secret name)
-*/}}
-{{- define "groombook.authSecretName" -}}
-{{- printf "%s" "groombook-auth" }}
-{{- end }}
@@ -50,27 +50,6 @@ spec:
            - name: OIDC_AUDIENCE
              value: {{ .Values.api.env.oidcAudience | quote }}
            {{- end }}
-            {{- if .Values.api.env.internalBaseUrl }}
-            - name: OIDC_INTERNAL_BASE
-              value: {{ .Values.api.env.internalBaseUrl | quote }}
-            {{- end }}
-            - name: BETTER_AUTH_URL
-              value: {{ .Values.api.env.betterAuthUrl | quote }}
-            - name: OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "groombook.authSecretName" . }}
-                  key: OIDC_CLIENT_ID
-            - name: OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "groombook.authSecretName" . }}
-                  key: OIDC_CLIENT_SECRET
-            - name: BETTER_AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "groombook.authSecretName" . }}
-                  key: BETTER_AUTH_SECRET
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
@@ -18,8 +18,6 @@ api:
    corsOrigin: ""
    oidcIssuer: ""
    oidcAudience: groombook
-    betterAuthUrl: ""
-    internalBaseUrl: ""
    port: "3000"
  service:
    type: ClusterIP
@@ -883,7 +883,6 @@ async function seed() {
  let appointmentCount = 0;
  let invoiceCount = 0;
  let visitLogCount = 0;
-  let paidInvoiceCounter = 0;

  // Process in batches per client to keep memory manageable
  const apptBatchSize = 100;
@@ -978,10 +977,6 @@ async function seed() {

        const invoiceStatus = rand() < 0.95 ? "paid" as const : "pending" as const;
        const paidAt = invoiceStatus === "paid" ? new Date(endTime.getTime() + randInt(5, 30) * 60 * 1000) : null;
-        paidInvoiceCounter++;
-        const stripePaymentIntentId = invoiceStatus === "paid"
-          ? `pi_test_seed_${String(paidInvoiceCounter).padStart(6, "0")}`
-          : null;

        invoiceBatch.push({
          id: invoiceId,
@@ -994,7 +989,6 @@ async function seed() {
          status: invoiceStatus,
          paymentMethod: invoiceStatus === "paid" ? pick(["cash", "card", "card", "card", "check"]) as "cash" | "card" | "check" : null,
          paidAt,
-          stripePaymentIntentId,
          notes: rand() < 0.05 ? "Added extra service at checkout" : null,
        });

@@ -1098,16 +1092,13 @@ async function seed() {
      const taxCents = Math.round(effectivePrice * 0.08);
      const totalCents = effectivePrice + taxCents + tipCents;
      const paidAt = new Date(endTime.getTime() + randInt(5, 30) * 60 * 1000);
-      paidInvoiceCounter++;

      invoiceBatch.push({
        id: invoiceId, appointmentId: apptId, clientId,
        subtotalCents: effectivePrice, taxCents, tipCents, totalCents,
        status: "paid" as const,
        paymentMethod: pick(["cash", "card", "card", "card", "check"]) as "cash" | "card" | "check",
-        paidAt,
-        stripePaymentIntentId: `pi_test_seed_${String(paidInvoiceCounter).padStart(6, "0")}`,
-        notes: null,
+        paidAt, notes: null,
      });
      lineItemBatch.push({
        id: uuid(), invoiceId, description: svc.name, quantity: 1,