belviskhoremk 3504790216 fix: address final whole-branch review findings for Phase 2B admin panel ...

Consolidated fix wave for 1 Critical + 6 Important findings from the final
review before merge:

- Critical: marking a booking completed no longer frees its booked_slots
  mirror row or the unique-slot index, closing a double-booking hole
  (new migration 20260812110508, with regression pgTAP tests added first
  and confirmed failing against the old trigger/index).
- uploadSalonImage() now returns the storage-relative path instead of an
  absolute public URL, so products/services.image stays one consistent
  format.
- The product/service Id field is disabled while editing, preventing
  accidental duplicate rows from an upsert keyed on a changed id.
- Cancel / Mark completed in AdminBookings now require window.confirm,
  matching the existing delete-confirmation pattern.
- /admin and any unmatched /admin/* path now redirect to /admin/products
  instead of rendering blank.
- Public signup is disabled in supabase/config.toml, and ProtectedRoute
  adds a defense-in-depth check that the session belongs to the admin
  user id, not just that a session exists.
- Product/service delete now surfaces a friendly message for FK-violation
  errors (23503) via a new friendlyError() helper, instead of a raw
  Postgres error string.

Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH

2026-08-12 13:12:41 +02:00

16 KiB

Raw Blame History

View Raw