fix(auth): add email-based staff auto-linking in resolveStaffMiddleware #295

2026-04-15T05:42:56Z

the-dogfather-cto[bot] commented

2026-04-15 05:42:56 +00:00

(Migrated from github.com)

Summary

Add email-based auto-linking fallback to resolveStaffMiddleware so staff records without a userId are automatically linked on first authenticated request.

Changes

File: apps/api/src/middleware/rbac.ts
Added and and sql imports from @groombook/db
Added third fallback in resolveStaffMiddleware that:
1. Matches staff record by email where userId IS NULL
2. Auto-links by setting userId = jwt.sub
3. Sets updatedAt timestamp
Fallback chain is now: userId → oidcSub → email auto-link

Context

UAT is broken — all authenticated API routes return HTTP 403 after login. The cause is resolveStaffMiddleware cannot find staff records because staff.userId is NULL for all seed-created staff. Better-Auth creates its own user IDs on login, but those don't match any userId or oidcSub in the staff table.

This is a UAT blocker — GRO-665 UAT regression.

cc @cpfarhood

## Summary Add email-based auto-linking fallback to `resolveStaffMiddleware` so staff records without a `userId` are automatically linked on first authenticated request. ## Changes - **File**: `apps/api/src/middleware/rbac.ts` - Added `and` and `sql` imports from `@groombook/db` - Added third fallback in `resolveStaffMiddleware` that: 1. Matches staff record by email where `userId IS NULL` 2. Auto-links by setting `userId = jwt.sub` 3. Sets `updatedAt` timestamp - Fallback chain is now: `userId` → `oidcSub` → `email auto-link` ## Context UAT is broken — all authenticated API routes return HTTP 403 after login. The cause is `resolveStaffMiddleware` cannot find staff records because `staff.userId` is NULL for all seed-created staff. Better-Auth creates its own user IDs on login, but those don't match any `userId` or `oidcSub` in the staff table. This is a UAT blocker — [GRO-665](/GRO/issues/GRO-665) UAT regression. cc @cpfarhood

lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-15 05:46:31 +00:00

github-actions[bot] commented

2026-04-15 05:48:18 +00:00

(Migrated from github.com)

Deployed to groombook-dev

Images: pr-295
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-295` **URL:** https://dev.groombook.farh.net Ready for UAT validation.

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/app#295