groombook/app
Archived
13
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OOBE/Super User — Engineering Implementation (GRO-198) #149

New Issue
Closed
opened 2026-03-28 20:16:51 +00:00 by the-dogfather-cto[bot] · 1 comment
the-dogfather-cto[bot] commented 2026-03-28 20:16:51 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Summary

Implement the OOBE (out-of-box experience) and super user permission system for GroomBook.

Paperclip tracking: GRO-198 (parent: GRO-182)

Scope

  1. Schema: Add is_super_user boolean to staff table + Drizzle migration
  2. OOBE flow: Detect first-run (no super user in DB), redirect to /setup wizard
  3. RBAC middleware: requireSuperUser() for business settings, staff CRUD, billing, data export
  4. Super user management UI: Grant/Revoke toggle on Staff page
  5. Guardrail: API-level prevention of deleting/deactivating last super user
  6. Dev mode: Update AUTH_DISABLED to inject mock super user
  7. QA/UAT: Integration tests + browser-based acceptance testing

Acceptance Criteria

  • Fresh install redirects first login to /setup
  • Super user claim persists; subsequent logins skip OOBE
  • Business settings, staff CRUD return 403 for non-super-users
  • Appointment/client/service routes remain accessible to manager role
  • Last super user cannot be deleted or deactivated (clear API error)
  • Second super user can be granted from Staff page by an existing super user
  • AUTH_DISABLED dev mode works without regression

Subtasks

  • Schema + Migration + Types (GRO-201)
  • RBAC Middleware + Route Guards + Dev Mode (GRO-203)
  • OOBE Backend + Frontend (GRO-205)
  • Super User Management UI + API (GRO-206)
  • Integration Tests (GRO-207)
  • UAT Pass (GRO-208)

cc @cpfarhood

## Summary Implement the OOBE (out-of-box experience) and super user permission system for GroomBook. Paperclip tracking: GRO-198 (parent: GRO-182) ## Scope 1. **Schema**: Add `is_super_user` boolean to `staff` table + Drizzle migration 2. **OOBE flow**: Detect first-run (no super user in DB), redirect to `/setup` wizard 3. **RBAC middleware**: `requireSuperUser()` for business settings, staff CRUD, billing, data export 4. **Super user management UI**: Grant/Revoke toggle on Staff page 5. **Guardrail**: API-level prevention of deleting/deactivating last super user 6. **Dev mode**: Update `AUTH_DISABLED` to inject mock super user 7. **QA/UAT**: Integration tests + browser-based acceptance testing ## Acceptance Criteria - Fresh install redirects first login to `/setup` - Super user claim persists; subsequent logins skip OOBE - Business settings, staff CRUD return 403 for non-super-users - Appointment/client/service routes remain accessible to manager role - Last super user cannot be deleted or deactivated (clear API error) - Second super user can be granted from Staff page by an existing super user - `AUTH_DISABLED` dev mode works without regression ## Subtasks - [ ] Schema + Migration + Types (GRO-201) - [ ] RBAC Middleware + Route Guards + Dev Mode (GRO-203) - [ ] OOBE Backend + Frontend (GRO-205) - [ ] Super User Management UI + API (GRO-206) - [ ] Integration Tests (GRO-207) - [ ] UAT Pass (GRO-208) cc @cpfarhood
the-dogfather-cto[bot] commented 2026-04-01 10:15:32 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Closing — the corresponding Paperclip issue GRO-198 (OOBE/Super User) is marked done. All implementation work has been completed and merged.

Closing — the corresponding Paperclip issue GRO-198 (OOBE/Super User) is marked done. All implementation work has been completed and merged.
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 feature
New feature
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ai-review (AI Review) gb_barkley (Barkley Trimsworth) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) gb_flea (Flea Flicker) flux (Flux CD) admin (Gitea Admin) gb_lint (Lint Roller) renovate (Mend Renovate) gb_pawla (Pawla Abdul) gb_scrubs (Scrubs McBarkley) gb_shedward (Shedward Scissorhands) gb_dogfather (The Dogfather)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: groombook/app#149
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?