Blittech/braidsbymira
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: replace admin account with admin@braidsbymira.com

Browse Source 
Swaps the single fixed admin UUID that every admin-write/admin-read RLS
policy and the frontend's ProtectedRoute check against, moving off the
personal belviskhoremk@gmail.com account onto a dedicated
admin@braidsbymira.com login created via the Auth admin API. Updates
the RLS test suite's admin-impersonation UUID to match.

Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH
This commit is contained in:
belviskhoremk
2026-08-12 23:51:49 +02:00
parent 56679b872b
commit f41c6f5812
5 changed files with 46 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/components/ProtectedRoute.test.tsx
View File

@@ -36,7 +36,7 @@ describe('ProtectedRoute', () => {
it('renders the protected content when there is an admin session', () => {
adminAuthMock.mockReturnValue({
session: { user: { id: '21c90224-e0b2-412e-a431-8e7f097c1cef' } },
session: { user: { id: '2b88676b-f901-459a-9147-b914190c4f81' } },
loading: false,
})
renderWithRoute()

2
src/components/ProtectedRoute.tsx
View File

@@ -7,7 +7,7 @@ import useAdminAuth from '../hooks/useAdminAuth'
// defense-in-depth: it ensures the admin UI itself never renders for an
// authenticated session that isn't the admin's, even if signup were ever
// re-enabled or a session existed for some other reason.
const ADMIN_USER_ID = '21c90224-e0b2-412e-a431-8e7f097c1cef'
const ADMIN_USER_ID = '2b88676b-f901-459a-9147-b914190c4f81'
function ProtectedRoute() {
const { session, loading } = useAdminAuth()

2
src/pages/admin/AdminApp.test.tsx
View File

@@ -3,7 +3,7 @@ import { MemoryRouter, Routes, Route } from 'react-router-dom'
import { describe, it, expect, vi } from 'vitest'
vi.mock('../../hooks/useAdminAuth', () => ({
default: () => ({ session: { user: { id: '21c90224-e0b2-412e-a431-8e7f097c1cef' } }, loading: false }),
default: () => ({ session: { user: { id: '2b88676b-f901-459a-9147-b914190c4f81' } }, loading: false }),
}))
vi.mock('../../lib/supabase', () => ({
supabase: {

41
supabase/migrations/20260812214640_replace_admin_uuid.sql Normal file
View File

@@ -0,0 +1,41 @@
-- Replaces the fixed admin UUID that every admin-write/admin-read RLS policy
-- checks against. The salon is switching its login from the personal
-- belviskhoremk@gmail.com account (21c90224-e0b2-412e-a431-8e7f097c1cef) to a
-- dedicated admin@braidsbymira.com account
-- (2b88676b-f901-459a-9147-b914190c4f81), created via the Auth admin API.
-- This is a swap, not an addition: the old UUID loses admin write access.
alter policy "products_admin_write" on public.products
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "services_admin_write" on public.services
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "schedule_template_admin_write" on public.schedule_template
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "schedule_exceptions_admin_write" on public.schedule_exceptions
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "bookings_admin_all" on public.bookings
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "booked_slots_admin_write" on public.booked_slots
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "inquiries_admin_all" on public.inquiries
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "notification_failures_admin_read" on public.notification_failures
using ((select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);
alter policy "salon_images_admin_write" on storage.objects
using (bucket_id = 'salon-images' and (select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid)
with check (bucket_id = 'salon-images' and (select auth.uid()) = '2b88676b-f901-459a-9147-b914190c4f81'::uuid);

4
supabase/tests/database/rls.test.sql
View File

@@ -88,7 +88,7 @@ select throws_ok(
-- The admin (matching UID) can read bookings
set local role authenticated;
set local request.jwt.claim.sub = '21c90224-e0b2-412e-a431-8e7f097c1cef';
set local request.jwt.claim.sub = '2b88676b-f901-459a-9147-b914190c4f81';
select isnt_empty(
$$ select * from public.bookings $$,
'admin can read bookings'
@@ -236,7 +236,7 @@ select throws_ok(
);
set local role authenticated;
set local request.jwt.claim.sub = '21c90224-e0b2-412e-a431-8e7f097c1cef';
set local request.jwt.claim.sub = '2b88676b-f901-459a-9147-b914190c4f81';
select lives_ok(
$$ insert into storage.objects (bucket_id, name) values ('salon-images', 'admin-test.jpg') $$,
'admin can upload to salon-images'