app/apps/api at 004e23f8bca0ad5788ea068ec4590f06d0c178ef - app

Archived

This repository has been archived on 2026-05-24. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

History

groombook-engineer[bot] 004e23f8bc fix(api): enforce requireSuperUser on settings PATCH and fix dev-mode auth bypass (#206 )

* fix(api): enforce requireSuperUser on settings PATCH and fix dev-mode auth bypass

- Add requireSuperUser() middleware to PATCH /api/admin/settings route
  to ensure only super users can modify business settings

- Fix dev-mode (AUTH_DISABLED=true) force-set of isSuperUser:true
  for all staff records in resolveStaffMiddleware. Now preserves
  actual database value with isSuperUser ?? false fallback.
  This prevents non-super-users (e.g., receptionists) from
  bypassing RBAC checks in dev mode.

- Fix test data: RECEPTIONIST and GROOMER now correctly have
  isSuperUser: false (was incorrectly inheriting true from MANAGER)

- Add 7 new tests for requireSuperUser middleware covering:
  - Super user access allowed
  - Non-super-user receptionist blocked with 403
  - Non-super-user groomer blocked with 403
  - Unresolved staff record returns 403
  - Receptionist cannot grant super user via PATCH
  - JSON error response format

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix(api): remove dead code in rbac test

Remove unused `app` variable from 'returns 403 when staff record is
not resolved' test - the test uses `testApp` instead.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: groombook-engineer[bot] <3141748+groombook-engineer[bot]@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>

2026-04-02 12:57:56 +00:00

src

fix(api): enforce requireSuperUser on settings PATCH and fix dev-mode auth bypass (#206 )

2026-04-02 12:57:56 +00:00

Dockerfile

Fix Dockerfile layer order: copy dist before pnpm install (#45 )

2026-03-18 03:44:39 +00:00

eslint.config.js

feat: appointment scheduling, client/pet/service/staff CRUD UI

2026-03-17 18:45:28 +00:00

package.json

feat(auth): replace OIDC/jose with Better-Auth (#136 )