This repository has been archived on 2026-05-24. You can view files and clone it. You cannot open issues or pull requests or push a commit.

groombook-engineer[bot] 804bb474d2 fix(api): enforce requireSuperUser on settings PATCH and fix dev-mode auth bypass ...

- Add requireSuperUser() middleware to PATCH /api/admin/settings route
  to ensure only super users can modify business settings

- Fix dev-mode (AUTH_DISABLED=true) force-set of isSuperUser:true
  for all staff records in resolveStaffMiddleware. Now preserves
  actual database value with isSuperUser ?? false fallback.
  This prevents non-super-users (e.g., receptionists) from
  bypassing RBAC checks in dev mode.

- Fix test data: RECEPTIONIST and GROOMER now correctly have
  isSuperUser: false (was incorrectly inheriting true from MANAGER)

- Add 7 new tests for requireSuperUser middleware covering:
  - Super user access allowed
  - Non-super-user receptionist blocked with 403
  - Non-super-user groomer blocked with 403
  - Unresolved staff record returns 403
  - Receptionist cannot grant super user via PATCH
  - JSON error response format

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-04-02 10:50:55 +00:00

..

api

fix(api): enforce requireSuperUser on settings PATCH and fix dev-mode auth bypass

2026-04-02 10:50:55 +00:00

e2e

fix(e2e): mock /api/setup/status to prevent redirect to /setup

2026-04-01 23:12:45 +00:00

web

fix(web): unmount CustomerPortal when navigating to /login

2026-04-02 01:22:45 +00:00