WorkClub Automation ffc4062eba fix: exempt /api/clubs/me from tenant validation ...

- Add path exemption in TenantValidationMiddleware for /api/clubs/me
- Change authorization policy from RequireMember to RequireViewer
- Fix KEYCLOAK_CLIENT_ID in docker-compose.yml (workclub-app not workclub-api)
- Endpoint now works without X-Tenant-Id header as intended
- Other endpoints still protected by tenant validation

This fixes the chicken-and-egg problem where frontend needs to call
/api/clubs/me to discover available clubs before selecting a tenant.

2026-03-05 21:32:37 +01:00

..

auth

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

rls

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

api-clubs-me.json

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

api-final-startup.txt

chore(final-wave): add F3 manual QA evidence and mark plan complete

2026-03-05 11:22:04 +01:00

api-health-check.txt

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

api-health-ipv4.txt

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

api-health-success.txt

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

api-logs-startup.txt

chore(final-wave): add F3 manual QA evidence and mark plan complete

2026-03-05 11:22:04 +01:00

api-tasks-club1.json

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

clubs-api-test.txt

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

clubs-list.json

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

CRITICAL-BLOCKER-REPORT.md

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

db-clubs-data.txt

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

debug-landing.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

docker-compose-up.txt

chore(final-wave): add F1, F2, F4 verification reports and mark plan checkboxes complete

2026-03-05 11:07:08 +01:00

e2e-01-landing.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

e2e-02-keycloak-login.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

e2e-03-dashboard.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

e2e-05-tasks.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

e2e-06-shifts.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

final-f3-manual-qa-report.md

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

FINAL-F3-QA-REPORT.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

infrastructure-qa.md

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

jwt-claims-admin.json

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

jwt-decoded.json

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

keycloak-health-debug.txt

chore(final-wave): add F1, F2, F4 verification reports and mark plan checkboxes complete

2026-03-05 11:07:08 +01:00

keycloak-logs.txt

chore(final-wave): add F1, F2, F4 verification reports and mark plan checkboxes complete

2026-03-05 11:07:08 +01:00

keycloak-token-admin.txt

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

keycloak-token-full.json

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

keycloak-token-success.json

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

phase2-rls-isolation.md

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

phase2-rls-tests.md

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

phase3-api-crud-tasks.md

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

phase3-blocker-no-sub-claim.md

chore(evidence): add QA evidence and notepads from debugging sessions

2026-03-05 19:22:55 +01:00

phase3-crud-scenarios.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase3-shift-scenarios-summary.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase3-task-scenarios-summary.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase4-frontend-scenarios-summary.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase5-integration-journey.sh

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase5-integration-summary.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase6-edge-cases-summary.md

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

phase6-edge-cases.sh

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

postgres-logs-2.txt

chore(final-wave): add F1, F2, F4 verification reports and mark plan checkboxes complete

2026-03-05 11:07:08 +01:00

postgres-logs.txt

chore(final-wave): add F1, F2, F4 verification reports and mark plan checkboxes complete

2026-03-05 11:07:08 +01:00

qa-execution-log.md

fix(keycloak): update user club attributes with real database UUIDs

2026-03-05 14:21:44 +01:00

s19-create-task.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s20-get-task.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s21-update-task.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s22-transition-assigned.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s23-transition-inprogress.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s24-transition-review.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s25-transition-done.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s26-invalid-transition.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s27-concurrent-update.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s28-delete-task.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s29-create-shift.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s30-get-shift.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s31-shift-signup.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s32-duplicate-signup.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s33-capacity-enforcement.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s34-cancel-signup.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s35-past-shift.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s36-login-success.png

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s42-51-journey-task-complete.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s42-51-shift-signup-count.txt

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s42-51-shift-signup.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s42-51-tenant-isolation.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s52-invalid-jwt.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s53-no-auth.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s54-unauthorized-tenant.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s55-sql-injection.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s56-xss-attempt.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00

s57-race-condition.json

fix: exempt /api/clubs/me from tenant validation

2026-03-05 21:32:37 +01:00