Space in `github.sha ::7` caused workflow validation to fail on push
events (0s run, no jobs). Fixes the template syntax so the SHA
subexpression is `github.sha::7`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Each CI build now produces an immutable tag (pr-N-sha7 or
YYYY.MM.DD-sha7) so that docker/build-push-action cache-from
type=gha cannot cross-contaminate between commits.
Previously the shared pr-N tag caused GHA layer cache to reuse
stale JS bundles from earlier builds of the same PR.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The guardrail should block ONLY when there are zero other active super
users. With the previous <= 1 condition, revoking/deleting a superuser
was incorrectly blocked when there were exactly 2 superusers total
(count of 1 other <= 1 triggered the block). Change to < 1 so that
having 1+ other superuser(s) correctly allows the operation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wrap c.json() in try/catch to surface any remaining serialization
errors rather than crashing with a generic 500. Also change the null-
staff guard from 404 → 500 since a missing staff context is an
internal error, not a not-found case.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Vite resolves .js before .tsx when both exist, causing stale compiled
JS output to shadow TSX source files. Add .gitignore exceptions for
legitimate standalone JS files.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add isSuperUser boolean to Staff interface in types
- Fetch current user via /api/staff/me to determine if super user
- Show "Super User" column and Grant/Revoke buttons only for super users
- Disable revoke button when target is the last active super user
- Show API error messages when last-super-user guardrail triggers
- Prevent self-revocation (no Grant/Revoke button on own row)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add explicit null check and field serialization for /api/staff/me
to prevent serialization errors with BigInt/Date fields
- Fix revoke: separate UPDATE from RETURNING in superuser guard
transaction to avoid FOR UPDATE + RETURNING issues in DB driver
- Add explicit updateStaffSchema with isSuperUser field (not derived
from createStaffSchema.partial())
Co-Authored-By: Paperclip <noreply@paperclip.ing>
groombook-ci[bot]