This repository has been archived on 2026-05-24. You can view files and clone it. You cannot open issues or pull requests or push a commit.

groombook-ci[bot] 30b49e82e8 fix(api): mount POST /api/setup under auth middleware — security fix ...

CRITICAL: Previously the entire setupRouter was mounted on the public `app`
(pre-auth), meaning POST /api/setup had no authentication and any anonymous
user could claim super user.

Now:
- GET /api/setup/status remains public (needed for OOBE redirect check)
- POST /api/setup is mounted on the authenticated /api basePath, requiring
  authMiddleware + resolveStaffMiddleware to run first

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-03-29 03:16:24 +00:00

..

api

fix(api): mount POST /api/setup under auth middleware — security fix

2026-03-29 03:16:24 +00:00

e2e

fix(e2e): clients.spec.ts strict mode — use .first() for ambiguous selector

2026-03-29 03:16:24 +00:00

web

fix(test): sync Appointments.test.tsx with portal refactor

2026-03-29 03:16:24 +00:00