Phase 6

Owner Administration is complete. Summary of this final stretch of work:

Seed data extended with an inactive staff member, a pending invitation, a redeemed-reward fixture, a service with no eligible staff, and a future-appointment fixture for conflict testing — all idempotent, verified against the dev DB.

Testing brought to 179 unit / 86 integration / 27 E2E tests, all passing together on a freshly seeded, disposable Postgres:

Unit tests for every new pure validator (business hours, categories/services, booking rules, loyalty config, staff creation).
Integration tests covering opening-hours conflicts, last-owner protection, staff deactivation/eligibility conflicts, loyalty redemption's atomic race-guard, and owner-vs-barber/business-isolation authorization — all against a real Postgres.
12 new Playwright owner journeys, which surfaced and fixed two genuine issues along the way: a cookie-clearing race condition in the sign-out-mid-test flow (a real, reproducible timing bug, not just a test artifact), and confirmation that seed fixtures upserted by deterministic ID go stale once "today" has moved on — now handled defensively.
Desktop responsiveness: converted the single-column Business Details, Booking Rules, and Loyalty Configuration forms to a genuine two-column layout at the lg: breakpoint (verified via measured element positions, not just screenshots), confirmed mobile stacking is unaffected.

Final verification: clean tsc, eslint, and next build, plus the full three-suite run against one fresh database as the authoritative pass.

src/features/owner/__tests__/authorization.integration.test.ts

@@ -0,0 +1,124 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { hasPermission } from "@/lib/auth/permissions";
+import { assertOwnerPermission, OwnerPermissionDeniedError } from "../authorization";
+import { deactivateStaff, updateStaffAsOwner } from "@/services/staff/staff.service";
+import { deleteCategory } from "@/services/catalogue/service-catalogue.service";
+import {
+  cleanupTestBusiness,
+  createTestBusiness,
+  createTestStaff,
+  prisma,
+} from "@/services/scheduling/__tests__/fixtures";
+import type { TestBusiness } from "@/services/scheduling/__tests__/fixtures";
+
+/**
+ * Real-DB coverage of "a normal barber must not be able to perform owner
+ * actions" and "owner actions never leak across businesses" — the two
+ * defense-in-depth rules the Phase 6 brief calls out repeatedly. This
+ * re-derives permissions from the database exactly as the owner Server
+ * Actions do (assertOwnerPermission -> hasPermission -> a fresh
+ * StaffProfile/Role/RolePermission query), rather than trusting a cached
+ * session claim.
+ */
+describe("Owner authorization and business isolation (integration)", () => {
+  let business: TestBusiness;
+
+  beforeEach(async () => {
+    business = await createTestBusiness();
+  });
+
+  afterEach(async () => {
+    await cleanupTestBusiness(business);
+  });
+
+  describe("hasPermission / assertOwnerPermission", () => {
+    it("grants MANAGE_STAFF to a staff member whose role holds it", async () => {
+      const ownerRole = await prisma.role.create({
+        data: {
+          businessId: business.businessId,
+          name: "Owner",
+          permissions: { create: [{ permission: "MANAGE_STAFF" }] },
+        },
+      });
+      const { userId } = await createTestStaff(business);
+      await prisma.staffProfile.update({ where: { userId }, data: { roleId: ownerRole.id } });
+
+      expect(await hasPermission(userId, "MANAGE_STAFF")).toBe(true);
+      await expect(assertOwnerPermission(userId, "MANAGE_STAFF")).resolves.toBeUndefined();
+    });
+
+    it("denies MANAGE_STAFF to an ordinary barber whose role doesn't hold it", async () => {
+      const { userId } = await createTestStaff(business); // createTestStaff's auto-role has no permissions
+
+      expect(await hasPermission(userId, "MANAGE_STAFF")).toBe(false);
+      await expect(assertOwnerPermission(userId, "MANAGE_STAFF")).rejects.toBeInstanceOf(OwnerPermissionDeniedError);
+    });
+
+    it("reflects a permission change immediately — no caching across the role edit", async () => {
+      const barberRole = await prisma.role.create({ data: { businessId: business.businessId, name: "Barber" } });
+      const { userId } = await createTestStaff(business);
+      await prisma.staffProfile.update({ where: { userId }, data: { roleId: barberRole.id } });
+      expect(await hasPermission(userId, "MANAGE_SERVICES")).toBe(false);
+
+      await prisma.rolePermission.create({ data: { roleId: barberRole.id, permission: "MANAGE_SERVICES" } });
+      expect(await hasPermission(userId, "MANAGE_SERVICES")).toBe(true);
+    });
+  });
+
+  describe("business isolation", () => {
+    it("updateStaffAsOwner can't reach a staff member from a different business", async () => {
+      const otherBusiness = await createTestBusiness();
+      try {
+        const { staffId: otherStaffId } = await createTestStaff(otherBusiness);
+        const result = await updateStaffAsOwner(prisma, {
+          staffId: otherStaffId,
+          businessId: business.businessId,
+          input: { bio: "hijacked" },
+        });
+        expect(result.success).toBe(false);
+        if (result.success) throw new Error("unreachable");
+        expect(result.validation.issues[0]?.code).toBe("STAFF_NOT_FOUND");
+
+        const unaffected = await prisma.staffProfile.findUniqueOrThrow({ where: { id: otherStaffId } });
+        expect(unaffected.bio).not.toBe("hijacked");
+      } finally {
+        await cleanupTestBusiness(otherBusiness);
+      }
+    });
+
+    it("deactivateStaff can't reach a staff member from a different business", async () => {
+      const otherBusiness = await createTestBusiness();
+      try {
+        const { staffId: otherStaffId } = await createTestStaff(otherBusiness);
+        const result = await deactivateStaff(prisma, { staffId: otherStaffId, businessId: business.businessId });
+        expect(result.success).toBe(false);
+
+        const unaffected = await prisma.staffProfile.findUniqueOrThrow({ where: { id: otherStaffId } });
+        expect(unaffected.status).toBe("ACTIVE");
+      } finally {
+        await cleanupTestBusiness(otherBusiness);
+      }
+    });
+
+    it("deleteCategory can't reach a category from a different business", async () => {
+      const otherBusiness = await createTestBusiness();
+      try {
+        // Move the other business's fixture category to be empty so only
+        // business-scoping (not the has-services guard) is under test.
+        await prisma.service.deleteMany({ where: { businessId: otherBusiness.businessId } });
+        const result = await deleteCategory(prisma, {
+          categoryId: otherBusiness.categoryId,
+          businessId: business.businessId,
+        });
+        expect(result.success).toBe(false);
+        if (result.success) throw new Error("unreachable");
+        expect(result.validation.issues[0]?.code).toBe("CATEGORY_NOT_FOUND");
+
+        const stillExists = await prisma.serviceCategory.findUnique({ where: { id: otherBusiness.categoryId } });
+        expect(stillExists).not.toBeNull();
+      } finally {
+        await cleanupTestBusiness(otherBusiness);
+      }
+    });
+  });
+});