[darcszn]

Summary

This PR fixes two production regressions affecting remittance access:

• GraphQL remittance resolvers were bypassing the row-level authorization that the REST route enforces for non-admin callers.
• Production bootstrap did not install the default remittance store, leaving the remittance APIs and GraphQL remittance queries unavailable in deployed runtime.

Root cause

SR-154: GraphQL remittance resolvers bypassed owner checks

The REST route for /api/remittances applies a role-aware filter before querying the store:

• admin callers may filter by agent
• non-admin callers are restricted to auth.userId

The GraphQL resolvers did not use the request context at all. As a result, any authenticated caller could query arbitrary remittance history through GraphQL by setting agent or by requesting a specific id.

SR-155: default remittance store not wired in production

createApp() accepted an optional remittanceStore, but the real process entry point index.ts never passed one in. The app therefore returned 503 Remittance store not configured in runtime even though a default store factory existed and was designed for production use.

Changes

• Enforced GraphQL row-level authorization in createResolvers() using the request GraphQLContext:
  • remittances now respects the same admin ? agent : userId rule as the REST endpoint
  • remittance(id) now returns null unless the user is admin or owns the remittance row
• Wired the default remittance store into the app startup path when DATABASE_URL is set and no explicit store is injected
• Added regression coverage for non-admin GraphQL access attempts to another user's remittance data

Files touched

• api/src/graphql/resolvers.ts
• api/src/app.ts
• api/src/__tests__/graphql.test.ts

Verification

This work was updated without running broad test or lint commands, per the request to skip checks during the patch cycle.

Notes

This PR intentionally keeps the changes narrowly scoped to the reported SR-154 and SR-155 regressions.