Fixes

Fixed an issue where media manager only shows files uploaded in specific sections.

Fixed an issue with icon picker names.

Removed jumbo rounding and a few other style tweaks.

prisma/migrations/20260804202231_phase10_loyalty_card_and_permission_fixes/migration.sql

@@ -0,0 +1,19 @@
+-- AlterTable
+ALTER TABLE `LoyaltyProgramme` ADD COLUMN `cardBorderColor` VARCHAR(191) NULL,
+    ADD COLUMN `cardFont` ENUM('SANS', 'SERIF', 'MONO') NOT NULL DEFAULT 'SANS',
+    ADD COLUMN `cardMemberNumberColor` VARCHAR(191) NULL,
+    ADD COLUMN `cardTopRightText` VARCHAR(191) NULL,
+    ADD COLUMN `cardTopRightTextColor` VARCHAR(191) NULL,
+    ADD COLUMN `cardTopRightTextSize` ENUM('SM', 'MD', 'LG') NOT NULL DEFAULT 'MD',
+    ADD COLUMN `rewardPosition` ENUM('AFTER_ALL_STAMPS', 'FINAL_SLOT_IS_REWARD') NOT NULL DEFAULT 'AFTER_ALL_STAMPS';
+
+-- Stamp-limit enforcement (Phase 10 follow-up brief: "Valid range: 1–10").
+-- Confirmed via a direct read of the live database before writing this
+-- migration that no existing LoyaltyProgramme row has stampsRequired > 10
+-- and no LoyaltyAccount has currentStamps > 10 — safe to add directly,
+-- no data migration needed. Defense-in-depth alongside the identical
+-- 1-10 check in validateProgrammeConfig() and the owner form's client
+-- validation; MySQL 8.0.16+ enforces CHECK constraints (this app's
+-- documented target, see schema.prisma's own header).
+ALTER TABLE `LoyaltyProgramme` ADD CONSTRAINT `LoyaltyProgramme_stampsRequired_range`
+    CHECK (`stampsRequired` BETWEEN 1 AND 10);

prisma/migrations/20260804202300_phase10_backfill_owner_permissions/migration.sql

@@ -0,0 +1,31 @@
+-- Backfill MANAGE_MEDIA_LIBRARY and MANAGE_REVIEWS (added in Phase 9)
+-- onto every role that already holds MANAGE_STAFF — the app's existing
+-- definition of "owner" (see src/services/staff/staff.service.ts's
+-- countOtherActiveManagers, "A role holding MANAGE_STAFF is this app's
+-- definition of 'an owner'"). syncRolePermissions() only ever runs at
+-- install/seed time, so any business installed before Phase 9 has its
+-- Owner role stuck on the old 15-permission set — confirmed by reading
+-- the actual RolePermission rows on a real installed business before
+-- writing this migration.
+--
+-- This is what silently made /owner/settings/reviews redirect away
+-- (hasPermission(..., MANAGE_REVIEWS) failing, redirecting to /staff,
+-- which then renders the barber calendar — looking exactly like
+-- "Reviews opens Calendar") and made Media Manager deletes silently fail
+-- (MANAGE_MEDIA_LIBRARY). Not a routing bug — a missing data backfill.
+--
+-- Idempotent: a fresh install's Owner role already has both permissions
+-- from syncRolePermissions() at install time, and INSERT IGNORE plus the
+-- existing @@unique([roleId, permission]) constraint make re-running
+-- this migration (or running it against an already-correct database)
+-- a safe no-op.
+
+INSERT IGNORE INTO `RolePermission` (`id`, `roleId`, `permission`)
+SELECT UUID(), owner.`roleId`, 'MANAGE_MEDIA_LIBRARY'
+FROM `RolePermission` owner
+WHERE owner.`permission` = 'MANAGE_STAFF';
+
+INSERT IGNORE INTO `RolePermission` (`id`, `roleId`, `permission`)
+SELECT UUID(), owner.`roleId`, 'MANAGE_REVIEWS'
+FROM `RolePermission` owner
+WHERE owner.`permission` = 'MANAGE_STAFF';

prisma/migrations/20260804202400_phase10_rewrite_legacy_media_urls/migration.sql

@@ -0,0 +1,31 @@
+-- Rewrite any already-stored `/media/...` URLs (the pre-Phase-10 upload
+-- path, which never actually worked in production — Next.js 16's
+-- `next start` does not dynamically serve files added to public/ after
+-- the build; see src/lib/media/media-storage.ts's header for the full
+-- account) to the new `/api/media/...` prefix served by
+-- src/app/api/media/[...path]/route.ts.
+--
+-- Confirmed via a direct read of the live database before writing this
+-- migration: exactly one MediaAsset row and its matching
+-- BusinessGalleryImage row use the old prefix; every other image field
+-- currently stores a full external URL (Business.logoUrl/coverImageUrl,
+-- etc.) and is untouched by this. Every statement below is still
+-- included for completeness/safety, covers every image column that can
+-- receive a MediaPicker-sourced URL, and is a no-op wherever nothing
+-- matches.
+--
+-- Idempotent: re-running finds nothing left matching `/media/%` (rows
+-- already rewritten now start with `/api/media/%`), so this is safe to
+-- apply more than once.
+
+UPDATE `MediaAsset` SET `url` = CONCAT('/api', `url`) WHERE `url` LIKE '/media/%';
+UPDATE `BusinessGalleryImage` SET `imageUrl` = CONCAT('/api', `imageUrl`) WHERE `imageUrl` LIKE '/media/%';
+UPDATE `Business` SET `logoUrl` = CONCAT('/api', `logoUrl`) WHERE `logoUrl` LIKE '/media/%';
+UPDATE `Business` SET `coverImageUrl` = CONCAT('/api', `coverImageUrl`) WHERE `coverImageUrl` LIKE '/media/%';
+UPDATE `Business` SET `faviconUrl` = CONCAT('/api', `faviconUrl`) WHERE `faviconUrl` LIKE '/media/%';
+UPDATE `Business` SET `appIconUrl` = CONCAT('/api', `appIconUrl`) WHERE `appIconUrl` LIKE '/media/%';
+UPDATE `Business` SET `welcomeBackgroundDesktopUrl` = CONCAT('/api', `welcomeBackgroundDesktopUrl`) WHERE `welcomeBackgroundDesktopUrl` LIKE '/media/%';
+UPDATE `Business` SET `welcomeBackgroundMobileUrl` = CONCAT('/api', `welcomeBackgroundMobileUrl`) WHERE `welcomeBackgroundMobileUrl` LIKE '/media/%';
+UPDATE `LoyaltyProgramme` SET `cardBackgroundImageUrl` = CONCAT('/api', `cardBackgroundImageUrl`) WHERE `cardBackgroundImageUrl` LIKE '/media/%';
+UPDATE `Service` SET `imageUrl` = CONCAT('/api', `imageUrl`) WHERE `imageUrl` LIKE '/media/%';
+UPDATE `User` SET `image` = CONCAT('/api', `image`) WHERE `image` LIKE '/media/%';