diff --git a/docs/api/README.md b/docs/api/README.md index 6349c4ff0..1d4ddd005 100644 --- a/docs/api/README.md +++ b/docs/api/README.md @@ -66,7 +66,13 @@ before treating a warning as a regression. `health:write`), audience-bound to `/mcp` and refused on REST writes; - `POST /api/tokens/measurements` mints `measurements:write`, accepted by `POST /api/measurements` and `POST /api/measurements/batch` only, on the - holder's own record only. + holder's own record only; + - `POST /api/tokens/workouts` mints `workouts:write`, accepted by + `POST /api/workouts/batch` only, on the holder's own record only; the + workouts it writes carry `source: EXTERNAL`; + - `POST /api/tokens/documents` mints `documents:write`, accepted by + `POST /api/documents/inbound` and `GET /api/documents/inbound/source` + only. `POST /api/tokens` is **not** among them — that generic mint was removed in v1.30.17. The path still lists (`GET`) and revokes (`DELETE /api/tokens/{id}`) diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index ed7a4c391..60b72dce6 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -2134,10 +2134,10 @@ paths: description: >- Stamps the calling browser session as recently re-proved, so for the next five minutes it may run the actions that ask for a fresh proof: GET /api/export/full-backup, POST /api/export/encrypted, POST /api/share-links, POST - /api/mcp/tokens, POST /api/tokens/measurements, POST /api/tokens/documents, and the admin backup download, - upload and restore, the admin data wipe and the admin password reset. Those answer 401 `auth.reproof.required` - with `meta.methods` (the proofs this account can give) when the session signed in or re-proved more than five - minutes ago. + /api/mcp/tokens, POST /api/tokens/measurements, POST /api/tokens/workouts, POST /api/tokens/documents, and the + admin backup download, upload and restore, the admin data wipe and the admin password reset. Those answer 401 + `auth.reproof.required` with `meta.methods` (the proofs this account can give) when the session signed in or + re-proved more than five minutes ago. The body takes the same shapes as POST /api/auth/step-up. On an account with a second factor only `totp`, @@ -2977,10 +2977,10 @@ paths: because that scope reached no ingest route while the pre-fail-closed default let it reach everything else. The credentials that work are minted where they are scoped: the per-medication API-endpoint toggle, `POST /api/mcp/tokens` for a connector, the sibling `POST /api/tokens/measurements` for third-party measurement - ingest, and `POST /api/tokens/documents` for document upload from another system. And unlike the revoke, this - read is NOT gated on the operator's instance-wide API switch: that switch governs the surfaces a token is for, - not a token's ability to authenticate, so tokens stay live while it is off and their owner has to be able to see - them. + ingest, `POST /api/tokens/workouts` for workout ingest from a bridge, and `POST /api/tokens/documents` for + document upload from another system. And unlike the revoke, this read is NOT gated on the operator's + instance-wide API switch: that switch governs the surfaces a token is for, not a token's ability to + authenticate, so tokens stay live while it is off and their owner has to be able to see them. responses: "200": description: The caller's tokens, newest first. @@ -3088,6 +3088,93 @@ paths: application/json: schema: $ref: "#/components/schemas/ErrorEnvelope" + /api/tokens/workouts: + post: + tags: + - Auth + summary: Mint a workout-ingest token + description: >- + Mints a Bearer scoped to exactly `workouts:write` and audits the mint. THE RESPONSE CARRIES THE RAW TOKEN, once; + it is stored as an HMAC and no path re-reveals it. + + + **What it can do.** `POST /api/workouts/batch`, on its owner's own record, and nothing else. It is the door a + workout bridge pushes through: a watch vendor's sync relayed by a small service, or a script replaying an + exported history. Workouts it writes carry `source: EXTERNAL`, resolved from the credential rather than taken + from the body, and a batch in which any entry names a source is refused 422 + (`workout.batch.source_not_permitted`) rather than relabelled. `EXTERNAL` is on no default source ladder, so + when the phone also recorded the same session the phone's copy is the one the workout list shows. + + + **What it cannot do.** List or read a workout, reach the measurement or document ingest routes, act on a shared + record, or mint another token. It is a separate scope from `measurements:write` on purpose: a token already + handed to a scale does not start accepting workouts, and a `measurements:write` token is refused 403 on the + workout batch. Every other route names no scope and refuses it 403. + + + Minting requires a COOKIE SESSION with a fresh proof, as for the measurement mint, for the reason it gives: a + day-lived native access token must not be able to leave behind a year-lived credential. Gated by the operator's + instance-wide API switch. Body capped at 16 KiB; 10 mints per user per minute, and at most 10 live workout + tokens held at once. Tokens appear in `GET /api/tokens` and are revoked at `DELETE /api/tokens/{id}`. + requestBody: + required: true + content: + application/json: + schema: + $ref: "#/components/schemas/CreateWorkoutTokenRequest" + responses: + "201": + description: Token minted. The `token` field is the only copy of the secret. + content: + application/json: + schema: + $ref: "#/components/schemas/CreateWorkoutTokenEnvelope" + "400": + description: Body is not parseable JSON. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" + "401": *a1 + "403": + description: The operator has switched the API off instance-wide. Nothing was minted. A Bearer caller is refused 401 + before the switch is read. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" + "409": + description: The account already holds 10 live workout tokens (`meta.errorCode` = `tokens.workouts.ceiling_reached`). + Nothing was minted. Revoke one at `DELETE /api/tokens/{id}`; only live tokens carrying `workouts:write` + count. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" + "413": + description: Body exceeds 16 KiB. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" + "415": + description: Content-Type is not `application/json`. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" + "422": + description: Validation failed. The envelope carries every offending issue. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" + "429": + description: More than 10 mints from this account in a minute. Nothing was minted. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" /api/tokens/documents: post: tags: @@ -4579,16 +4666,26 @@ paths: tags: - Measurements summary: Typed workout batch ingest (v1.4.25 W16b) - description: 'Server-side ingest endpoint for HKWorkout records (iOS) and Withings activity rows (server-to-server). Up - to 100 workouts per call; nested route geometry (GeoJSON LineString) is capped at 20 000 points and stored in a - 1:1 `WorkoutRoute` row keyed by `workoutId`. Idempotent via the `Idempotency-Key` header (replay window 24h). + description: >- + Server-side ingest endpoint for HKWorkout records (iOS) and Withings activity rows (server-to-server). Up to 100 + workouts per call; nested route geometry (GeoJSON LineString) is capped at 20 000 points and stored in a 1:1 + `WorkoutRoute` row keyed by `workoutId`. Idempotent via the `Idempotency-Key` header (replay window 24h). Per-entry status (`inserted | duplicate | enriched | skipped`) lets the iOS sync cursor checkpoint accurately. An entry matching a stored workout is first-write-wins for the workout row; when it carries a `samples` array and the stored workout has no heart-rate series, the series is attached and the entry reports `enriched` (repeatable: a workout that already has a series is a no-op). An entry whose `samples` array fails validation is refused on its own with `reason: "invalid_samples"` — the rest of the batch still lands. The request body ceiling is 5 MB enforced at the HTTP layer — clients above the ceiling receive a 413 with - `workout.batch.payload_too_large`.' + `workout.batch.payload_too_large`. + + + **Narrow token.** Also reachable with a `workouts:write` Bearer (minted at `POST /api/tokens/workouts`), the + supported way to push workouts from a bridge that is not the phone. This route is the scope's only one. Such a + credential writes only on its owner's own record; its workouts are attributed `EXTERNAL`, resolved from the + credential, and it may not name a source itself, so a batch in which any entry carries one, `MANUAL` and + `APPLE_HEALTH` alike, is refused 422 (`workout.batch.source_not_permitted`) and nothing is written. `EXTERNAL` + gives those writes their own `(userId, source, externalId)` namespace, so a bridge's ids can never collide with + the phone's. Every other narrow token, `measurements:write` included, is refused 403. parameters: - *a6 requestBody: @@ -4618,7 +4715,14 @@ paths: application/json: schema: $ref: "#/components/schemas/ErrorEnvelope" - "422": *a4 + "422": + description: A narrow `workouts:write` credential sent a batch in which an entry names a source, any source + (`workout.batch.source_not_permitted`). Nothing was written; resending the batch unchanged is refused the + same way. Omit `source` and the server attributes the rows `EXTERNAL`. + content: + application/json: + schema: + $ref: "#/components/schemas/ErrorEnvelope" "429": *a5 /api/devices: post: @@ -22919,6 +23023,21 @@ components: permission array is a literal, so no request can widen it. `name` is what the token is listed under — name it after the thing you are pasting it into, because that is what you will be reading when you decide whether to revoke it. `expiresInDays` defaults to 365." + CreateWorkoutTokenRequest: + type: object + properties: + name: + type: string + minLength: 1 + maxLength: 100 + expiresInDays: + type: integer + minimum: 1 + maximum: 365 + required: + - name + description: "Mint a workout-ingest Bearer. No `scope` field: the endpoint mints one shape. `name` is what the token is + listed under; name it after the bridge it is pasted into. `expiresInDays` defaults to 365." CreateDocumentTokenRequest: type: object properties: @@ -31636,10 +31755,11 @@ components: sharing.revoke.not_found, sharing.session.changed, sharing.switch.invalid, sharing.switch.wrong_transport; source-priority — source-priority.body.invalid_json, source-priority.body.invalid_shape; tokens — tokens.documents.ceiling_reached, - tokens.measurements.ceiling_reached; vaccination — vaccination.booster-invalid, - vaccination.booster-no-antigen, vaccination.booster-out-of-scope, vaccination.encounter-not-found, - vaccination.identity-required, vaccination.invalid, vaccination.link.invalid, vaccination.not-found, - vaccination.practitioner-not-found; workout — workout.batch.invalid, workout.batch.payload_too_large, + tokens.measurements.ceiling_reached, tokens.workouts.ceiling_reached; vaccination — + vaccination.booster-invalid, vaccination.booster-no-antigen, vaccination.booster-out-of-scope, + vaccination.encounter-not-found, vaccination.identity-required, vaccination.invalid, + vaccination.link.invalid, vaccination.not-found, vaccination.practitioner-not-found; workout — + workout.batch.invalid, workout.batch.payload_too_large, workout.batch.source_not_permitted, workout.batch.too_large; (unprefixed) — about_me_conflict, ai_response_truncated, coach_prefs_conflict, dashboard_layout_conflict, empty_file, health_score_config_conflict, insights_layout_conflict, invalid_base_updated_at, json_carries_no_intake_time, json_not_an_array, medication_layout_conflict, @@ -39650,6 +39770,42 @@ components: - expiresAt additionalProperties: false description: The one response that carries a usable measurement-ingest Bearer value. + CreateWorkoutTokenEnvelope: + type: object + properties: + data: + $ref: "#/components/schemas/CreateWorkoutTokenResponse" + error: + type: "null" + meta: + type: object + properties: + requestId: + type: string + additionalProperties: false + required: + - data + - error + additionalProperties: false + CreateWorkoutTokenResponse: + type: object + properties: + token: + type: string + description: The raw `hlk_` Bearer, RETURNED EXACTLY ONCE. It is stored only as an HMAC-SHA256 hash and cannot be + retrieved later. Treat it as a secret. + name: + type: string + expiresAt: + type: string + format: date-time + pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ + required: + - token + - name + - expiresAt + additionalProperties: false + description: The one response that carries a usable workout-ingest Bearer value. CreateDocumentTokenEnvelope: type: object properties: @@ -40443,7 +40599,8 @@ components: - EXTERNAL description: Origin of the measurement. v1.4.23 added APPLE_HEALTH for the iOS HealthKit batch ingest path. v1.38.x added EXTERNAL for rows pushed in under a narrow `measurements:write` Bearer — a scale, a watch bridge, a - home-automation rule. No client may name that value on a write; the server resolves it from the credential. + home-automation rule — and workouts pushed in under a narrow `workouts:write` Bearer carry it too. No client may + name that value on a write; the server resolves it from the credential. SyncMeasurementTombstone: type: object properties: @@ -40910,8 +41067,8 @@ components: id: type: string description: Measurement row id; `sleep:` for a sleep night; `day:` for a day bucket (`pulse` / - `glucose` beyond 90 days); `hour:` for an hour bucket (`pulse` within 90 days when the - window holds more than 10 000 readings). + `glucose` beyond 90 days); `hour:` for an hour bucket (`pulse` / `glucose` within 90 days + when the window holds more than 10 000 readings). at: type: string format: date-time @@ -40985,9 +41142,11 @@ components: additionalProperties: false description: "iOS-friendly per-kind time series: one point per reading (or per reconstructed night for `sleep`), an explicit `unit` token, and a summary `stats` block. Sample-dense kinds are bucketed server-side: `pulse` and - `glucose` beyond 90 days per local day, and `pulse` within 90 days per local hour when the window holds more - than 10 000 readings (a bucket carries the mean as `value` and its range as `valueMin` / `valueMax`). `stats` is - always computed over the underlying readings, never over the buckets." + `glucose` beyond 90 days per local day, and `pulse` / `glucose` within 90 days per local hour when the window + holds more than 10 000 readings (a continuous glucose sensor, a watch recording heart rate every minute; a cuff + or fingerstick meter stays raw). A bucket carries the mean as `value`; a `pulse` bucket also carries its range + as `valueMin` / `valueMax`, and a `glucose` bucket is converted to the user's unit like a raw reading. `stats` + is always computed over the underlying readings, never over the buckets." ListMeasurementsResponse: type: object properties: diff --git a/messages/de.json b/messages/de.json index 8e8fd6197..cecd50085 100644 --- a/messages/de.json +++ b/messages/de.json @@ -533,7 +533,10 @@ "saveError": "Einnahme konnte nicht gespeichert werden.", "emptyTitle": "Noch keine Medikamente angelegt", "emptyDescription": "Lege zuerst ein Medikament mit Zeitfenster an, damit du die Einnahme protokollieren kannst.", - "emptyCta": "Medikament hinzufügen" + "emptyCta": "Medikament hinzufügen", + "noneActionableTitle": "Heute ist nichts einzunehmen", + "noneActionableDescription": "Deine Medikamente sind pausiert, sind nur dokumentiert, oder ihr Einnahmezeitraum hat noch nicht begonnen oder ist schon vorbei. Eine vergangene Einnahme kannst du weiterhin im Verlauf des Medikaments nachtragen.", + "noneActionableCta": "Zu den Medikamenten" }, "quickEntryDiscard": { "title": "Eintrag verwerfen?", @@ -6172,6 +6175,13 @@ "scopeNote": "Es kann ausschließlich neue Werte in deine eigene Akte eintragen — deine Daten nicht lesen, nichts ändern oder löschen und kein weiteres Token erstellen. Werte werden als von einem externen Gerät gekennzeichnet, damit du sie später erkennst, und lassen sich jederzeit korrigieren.", "createFailed": "Das Token konnte nicht erstellt werden. Bitte versuche es erneut." }, + "workoutsToken": { + "title": "Training-Tokens", + "description": "Erzeuge ein Token, damit eine Uhren-Brücke oder ein Sync-Skript deine Trainings eintragen kann.", + "detail": "Das Token wird nur einmal angezeigt.", + "scopeNote": "Es kann ausschließlich neue Trainings in deine eigene Akte eintragen. Es kann deine Daten nicht lesen, nichts ändern oder löschen und kein weiteres Token erstellen. Trainings, die darüber kommen, werden als von einem externen Gerät gekennzeichnet. Hat dein Telefon dieselbe Einheit aufgezeichnet, siehst du die Aufzeichnung des Telefons.", + "createFailed": "Das Token konnte nicht erstellt werden. Bitte versuche es erneut." + }, "documentsToken": { "title": "Dokument-Tokens", "description": "Erzeuge ein Token, damit Paperless-ngx, Papra oder das Import-Skript Dokumente in deine Ablage legen können.", @@ -7291,6 +7301,7 @@ "previewTitle": "Inhalt der Sicherung", "previewLoading": "Inhalt wird gelesen…", "previewUnavailable": "Inhalt konnte nicht gelesen werden — die Wiederherstellung bleibt möglich.", + "previewStillReading": "Diese Sicherung stammt aus einer früheren Version, deshalb wird ihr Inhalt vollständig gelesen. Bei einem großen Datenbestand dauert das eine Weile. Öffne diesen Dialog in ein paar Minuten noch einmal, dann steht er hier. Die Wiederherstellung hängt nicht davon ab.", "previewEmpty": "Die Datei enthält keine Datensätze.", "previewOther": "Weitere Datensätze", "previewMeasurements": "Messwerte", diff --git a/messages/en.json b/messages/en.json index 5e3ca017e..322af6ad7 100644 --- a/messages/en.json +++ b/messages/en.json @@ -533,7 +533,10 @@ "saveError": "Could not save medication intake.", "emptyTitle": "No medications yet", "emptyDescription": "Create a medication with a schedule first, then come back here to log the intake.", - "emptyCta": "Add medication" + "emptyCta": "Add medication", + "noneActionableTitle": "Nothing to take today", + "noneActionableDescription": "Your medications are paused, kept as a record, or their course has not started or has already ended. A past dose can still be added from a medication's history.", + "noneActionableCta": "Open medications" }, "quickEntryDiscard": { "title": "Discard this entry?", @@ -6172,6 +6175,13 @@ "scopeNote": "It can only add new readings to your own record — it cannot read your data, change or delete anything, or create another token. Readings are marked as coming from an external device, so you can tell them apart later, and you can still correct them yourself.", "createFailed": "The token could not be created. Please try again." }, + "workoutsToken": { + "title": "Workout tokens", + "description": "Mint a token so a watch bridge or a sync script can add your workouts.", + "detail": "The token is shown once.", + "scopeNote": "It can only add new workouts to your own record. It cannot read your data, change or delete anything, or create another token. Workouts it adds are marked as coming from an external device, and when your phone recorded the same session, you see the phone's copy.", + "createFailed": "The token could not be created. Please try again." + }, "documentsToken": { "title": "Document tokens", "description": "Mint a token so Paperless-ngx, Papra or the import script can add documents to your vault.", @@ -7291,6 +7301,7 @@ "previewTitle": "What this backup contains", "previewLoading": "Reading contents…", "previewUnavailable": "Contents could not be read — restoring is still possible.", + "previewStillReading": "This backup was made by an earlier version, so its contents are being read in full, which takes a while for a large record. Open this dialog again in a few minutes to see them. Restoring does not depend on it.", "previewEmpty": "The file contains no records.", "previewOther": "Other records", "previewMeasurements": "Measurements", diff --git a/messages/es.json b/messages/es.json index 21269dd95..06010c86e 100644 --- a/messages/es.json +++ b/messages/es.json @@ -533,7 +533,10 @@ "saveError": "No se ha podido guardar la toma.", "emptyTitle": "Aún no hay medicamentos", "emptyDescription": "Crea primero un medicamento con horario, después vuelve aquí para registrar la toma.", - "emptyCta": "Añadir medicamento" + "emptyCta": "Añadir medicamento", + "noneActionableTitle": "Nada que tomar hoy", + "noneActionableDescription": "Tus medicamentos están en pausa, se guardan solo como registro, o su tratamiento aún no ha empezado o ya ha terminado. Puedes seguir añadiendo una toma pasada desde el historial del medicamento.", + "noneActionableCta": "Abrir medicamentos" }, "quickEntryDiscard": { "title": "¿Descartar esta entrada?", @@ -6172,6 +6175,13 @@ "scopeNote": "Solo puede añadir mediciones nuevas a tu propio historial: no puede leer tus datos, ni modificar o borrar nada, ni crear otro token. Las mediciones se marcan como procedentes de un dispositivo externo, así las distingues más tarde, y puedes corregirlas igualmente.", "createFailed": "No se pudo crear el token. Inténtalo de nuevo." }, + "workoutsToken": { + "title": "Tokens de entrenamientos", + "description": "Crea un token para que un puente de tu reloj o un script de sincronización añadan tus entrenamientos.", + "detail": "El token se muestra una sola vez.", + "scopeNote": "Solo puede añadir entrenamientos nuevos a tu propio historial. No puede leer tus datos, ni modificar o borrar nada, ni crear otro token. Los entrenamientos que añade se marcan como procedentes de un dispositivo externo, y si tu teléfono registró la misma sesión, ves la copia del teléfono.", + "createFailed": "No se pudo crear el token. Inténtalo de nuevo." + }, "documentsToken": { "title": "Tokens de documentos", "description": "Crea un token para que Paperless-ngx, Papra o el script de importación añadan documentos a tu archivo.", @@ -7291,6 +7301,7 @@ "previewTitle": "Contenido de la copia", "previewLoading": "Leyendo el contenido…", "previewUnavailable": "No se pudo leer el contenido — restaurar sigue siendo posible.", + "previewStillReading": "Esta copia se hizo con una versión anterior, así que su contenido se está leyendo completo, y con un historial grande eso lleva un rato. Vuelve a abrir este diálogo en unos minutos para verlo. Restaurar no depende de ello.", "previewEmpty": "El archivo no contiene registros.", "previewOther": "Otros registros", "previewMeasurements": "Mediciones", diff --git a/messages/fr.json b/messages/fr.json index 40702c5b6..5135074b2 100644 --- a/messages/fr.json +++ b/messages/fr.json @@ -533,7 +533,10 @@ "saveError": "Impossible d’enregistrer la prise.", "emptyTitle": "Aucun médicament pour l’instant", "emptyDescription": "Crée d’abord un médicament avec un horaire, puis reviens ici pour saisir la prise.", - "emptyCta": "Ajouter un médicament" + "emptyCta": "Ajouter un médicament", + "noneActionableTitle": "Rien à prendre aujourd’hui", + "noneActionableDescription": "Tes médicaments sont en pause, conservés comme simple fiche, ou leur traitement n’a pas encore commencé ou est déjà terminé. Tu peux toujours ajouter une prise passée depuis l’historique du médicament.", + "noneActionableCta": "Ouvrir les médicaments" }, "quickEntryDiscard": { "title": "Abandonner cette saisie ?", @@ -6172,6 +6175,13 @@ "scopeNote": "Il peut uniquement ajouter de nouvelles mesures à votre propre dossier : il ne peut pas lire vos données, ni modifier ou supprimer quoi que ce soit, ni créer un autre jeton. Les mesures sont signalées comme provenant d'un appareil externe, ce qui vous permet de les reconnaître plus tard, et vous pouvez toujours les corriger.", "createFailed": "Le jeton n'a pas pu être créé. Veuillez réessayer." }, + "workoutsToken": { + "title": "Jetons d'entraînements", + "description": "Créez un jeton pour qu'une passerelle de montre ou un script de synchronisation ajoutent vos entraînements.", + "detail": "Le jeton n'est affiché qu'une fois.", + "scopeNote": "Il peut uniquement ajouter de nouveaux entraînements à votre propre dossier. Il ne peut pas lire vos données, ni modifier ou supprimer quoi que ce soit, ni créer un autre jeton. Les entraînements qu'il ajoute sont signalés comme provenant d'un appareil externe, et si votre téléphone a enregistré la même séance, c'est la copie du téléphone que vous voyez.", + "createFailed": "Le jeton n'a pas pu être créé. Veuillez réessayer." + }, "documentsToken": { "title": "Jetons de documents", "description": "Créez un jeton pour que Paperless-ngx, Papra ou le script d'import ajoutent des documents à votre coffre.", @@ -7291,6 +7301,7 @@ "previewTitle": "Contenu de la sauvegarde", "previewLoading": "Lecture du contenu…", "previewUnavailable": "Le contenu n'a pas pu être lu — la restauration reste possible.", + "previewStillReading": "Cette sauvegarde a été créée par une version antérieure, son contenu est donc lu en entier, ce qui prend un moment pour un gros dossier. Rouvrez cette fenêtre dans quelques minutes pour le voir. La restauration n'en dépend pas.", "previewEmpty": "Le fichier ne contient aucun enregistrement.", "previewOther": "Autres enregistrements", "previewMeasurements": "Mesures", diff --git a/messages/it.json b/messages/it.json index b47e86906..7ffad325e 100644 --- a/messages/it.json +++ b/messages/it.json @@ -533,7 +533,10 @@ "saveError": "Impossibile salvare l’assunzione.", "emptyTitle": "Ancora nessun farmaco", "emptyDescription": "Crea prima un farmaco con un orario, poi torna qui per registrarne l’assunzione.", - "emptyCta": "Aggiungi farmaco" + "emptyCta": "Aggiungi farmaco", + "noneActionableTitle": "Niente da prendere oggi", + "noneActionableDescription": "I tuoi farmaci sono in pausa, conservati solo come scheda, oppure la terapia non è ancora iniziata o è già terminata. Puoi comunque aggiungere un’assunzione passata dalla cronologia del farmaco.", + "noneActionableCta": "Apri i farmaci" }, "quickEntryDiscard": { "title": "Scartare questa voce?", @@ -6172,6 +6175,13 @@ "scopeNote": "Può soltanto aggiungere nuove misurazioni alla tua cartella: non può leggere i tuoi dati, modificare o eliminare nulla, né creare un altro token. Le misurazioni vengono contrassegnate come provenienti da un dispositivo esterno, così le riconosci in seguito, e puoi comunque correggerle.", "createFailed": "Non è stato possibile creare il token. Riprova." }, + "workoutsToken": { + "title": "Token per allenamenti", + "description": "Crea un token perché un ponte dell'orologio o uno script di sincronizzazione aggiungano i tuoi allenamenti.", + "detail": "Il token viene mostrato una sola volta.", + "scopeNote": "Può soltanto aggiungere nuovi allenamenti alla tua cartella. Non può leggere i tuoi dati, modificare o eliminare nulla, né creare un altro token. Gli allenamenti che aggiunge vengono contrassegnati come provenienti da un dispositivo esterno e, se il telefono ha registrato la stessa sessione, vedi la copia del telefono.", + "createFailed": "Non è stato possibile creare il token. Riprova." + }, "documentsToken": { "title": "Token per documenti", "description": "Crea un token perché Paperless-ngx, Papra o lo script di importazione aggiungano documenti al tuo archivio.", @@ -7291,6 +7301,7 @@ "previewTitle": "Contenuto del backup", "previewLoading": "Lettura del contenuto…", "previewUnavailable": "Impossibile leggere il contenuto — il ripristino resta possibile.", + "previewStillReading": "Questo backup è stato creato da una versione precedente, quindi il suo contenuto viene letto per intero, e con un archivio grande ci vuole un po'. Riapri questa finestra tra qualche minuto per vederlo. Il ripristino non dipende da questo.", "previewEmpty": "Il file non contiene record.", "previewOther": "Altri record", "previewMeasurements": "Misurazioni", diff --git a/messages/ko.json b/messages/ko.json index 8d83c54dc..28038e56f 100644 --- a/messages/ko.json +++ b/messages/ko.json @@ -533,7 +533,10 @@ "saveError": "복용 기록을 저장하지 못했어요.", "emptyTitle": "등록된 약이 없어요", "emptyDescription": "먼저 일정이 있는 약을 만든 뒤, 여기로 돌아와 복용을 기록하세요.", - "emptyCta": "약 추가" + "emptyCta": "약 추가", + "noneActionableTitle": "오늘 복용할 약이 없어요", + "noneActionableDescription": "약이 일시 중지되었거나 기록용으로만 보관 중이거나, 복용 기간이 아직 시작되지 않았거나 이미 끝났어요. 지난 복용은 약의 기록에서 계속 추가할 수 있어요.", + "noneActionableCta": "약 목록 열기" }, "quickEntryDiscard": { "title": "이 기록을 버릴까요?", @@ -6172,6 +6175,13 @@ "scopeNote": "본인 기록에 새 측정값을 추가하는 것만 할 수 있어요. 데이터를 읽거나, 무언가를 고치거나 지우거나, 다른 토큰을 만들 수는 없어요. 측정값은 외부 기기에서 온 것으로 표시되니 나중에 구분할 수 있고, 언제든 고칠 수 있어요.", "createFailed": "토큰을 만들지 못했어요. 다시 시도해 주세요." }, + "workoutsToken": { + "title": "운동 토큰", + "description": "시계 연동 브리지나 동기화 스크립트가 운동 기록을 추가할 수 있도록 토큰을 만들어요.", + "detail": "토큰은 한 번만 표시돼요.", + "scopeNote": "본인 기록에 새 운동을 추가하는 것만 할 수 있어요. 데이터를 읽거나, 무언가를 고치거나 지우거나, 다른 토큰을 만들 수는 없어요. 이 토큰으로 추가된 운동은 외부 기기에서 온 것으로 표시되고, 휴대폰이 같은 운동을 기록했다면 휴대폰의 기록이 보여요.", + "createFailed": "토큰을 만들지 못했어요. 다시 시도해 주세요." + }, "documentsToken": { "title": "문서 토큰", "description": "Paperless-ngx, Papra 또는 가져오기 스크립트가 문서함에 문서를 추가할 수 있도록 토큰을 만들어요.", @@ -7270,6 +7280,7 @@ "previewTitle": "이 백업에 담긴 내용", "previewLoading": "내용을 읽는 중…", "previewUnavailable": "내용을 읽지 못했어요 — 복원은 그래도 할 수 있어요.", + "previewStillReading": "이 백업은 이전 버전에서 만들어져서 내용을 처음부터 끝까지 읽고 있어요. 기록이 많으면 시간이 좀 걸려요. 몇 분 뒤에 이 창을 다시 열면 내용이 보여요. 복원은 이것과 상관없이 할 수 있어요.", "previewEmpty": "파일에 기록이 없어요.", "previewOther": "기타 기록", "previewMeasurements": "측정", diff --git a/messages/pl.json b/messages/pl.json index 2a7d361ea..295afc34f 100644 --- a/messages/pl.json +++ b/messages/pl.json @@ -533,7 +533,10 @@ "saveError": "Nie udało się zapisać przyjęcia.", "emptyTitle": "Brak leków", "emptyDescription": "Najpierw dodaj lek z harmonogramem, a potem wróć tutaj, aby zarejestrować jego przyjęcie.", - "emptyCta": "Dodaj lek" + "emptyCta": "Dodaj lek", + "noneActionableTitle": "Dziś nic do przyjęcia", + "noneActionableDescription": "Twoje leki są wstrzymane, zapisane tylko jako wpis albo ich kuracja jeszcze się nie zaczęła lub już się skończyła. Przeszłą dawkę nadal możesz dodać w historii leku.", + "noneActionableCta": "Otwórz leki" }, "quickEntryDiscard": { "title": "Odrzucić ten wpis?", @@ -6172,6 +6175,13 @@ "scopeNote": "Może wyłącznie dodawać nowe pomiary do Twojej dokumentacji — nie odczyta danych, niczego nie zmieni ani nie usunie i nie utworzy kolejnego tokenu. Pomiary są oznaczane jako pochodzące z urządzenia zewnętrznego, dzięki czemu później je rozpoznasz, i nadal możesz je poprawić.", "createFailed": "Nie udało się utworzyć tokenu. Spróbuj ponownie." }, + "workoutsToken": { + "title": "Tokeny treningów", + "description": "Utwórz token, aby mostek zegarka lub skrypt synchronizacji mogły dodawać Twoje treningi.", + "detail": "Token pokazujemy tylko raz.", + "scopeNote": "Może wyłącznie dodawać nowe treningi do Twojej dokumentacji. Nie odczyta danych, niczego nie zmieni ani nie usunie i nie utworzy kolejnego tokenu. Dodane przez niego treningi są oznaczane jako pochodzące z urządzenia zewnętrznego, a jeśli telefon zapisał tę samą sesję, widzisz zapis z telefonu.", + "createFailed": "Nie udało się utworzyć tokenu. Spróbuj ponownie." + }, "documentsToken": { "title": "Tokeny dokumentów", "description": "Utwórz token, aby Paperless-ngx, Papra lub skrypt importu mogły dodawać dokumenty do Twojego archiwum.", @@ -7291,6 +7301,7 @@ "previewTitle": "Zawartość kopii", "previewLoading": "Odczytywanie zawartości…", "previewUnavailable": "Nie udało się odczytać zawartości — przywracanie jest nadal możliwe.", + "previewStillReading": "Ta kopia powstała we wcześniejszej wersji, więc jej zawartość jest odczytywana w całości, co przy dużych danych chwilę trwa. Otwórz to okno ponownie za kilka minut, aby ją zobaczyć. Przywracanie od tego nie zależy.", "previewEmpty": "Plik nie zawiera rekordów.", "previewOther": "Inne rekordy", "previewMeasurements": "Pomiary", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a325f52c0..83e106bab 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -27,6 +27,11 @@ overrides: valibot@<1.4.2: ^1.4.2 '@humanfs/node@<0.16.8': ^0.16.8 esbuild@>=0.27.3 <0.28.1: ^0.28.1 + '@grpc/grpc-js@>=1.14.0 <1.14.5': ^1.14.5 + brace-expansion@<1.1.21: ^1.1.21 + brace-expansion@>=2.0.0 <2.1.7: ^2.1.7 + brace-expansion@>=4.0.0 <5.0.12: ^5.0.12 + undici@>=7.0.0 <7.29.1: ^7.29.1 importers: @@ -679,8 +684,8 @@ packages: '@floating-ui/utils@0.2.12': resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==} - '@grpc/grpc-js@1.14.4': - resolution: {integrity: sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==} + '@grpc/grpc-js@1.14.5': + resolution: {integrity: sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==} engines: {node: '>=12.10.0'} '@grpc/proto-loader@0.7.15': @@ -3525,14 +3530,14 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -6604,8 +6609,8 @@ packages: undici-types@8.9.0: resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} undici@8.11.2: @@ -7451,7 +7456,7 @@ snapshots: open: 8.4.2 picomatch: 4.0.5 systeminformation: 5.33.1 - undici: 7.29.0 + undici: 7.30.0 which: 4.0.0 yocto-spinner: 1.2.2 @@ -7583,7 +7588,7 @@ snapshots: '@floating-ui/utils@0.2.12': {} - '@grpc/grpc-js@1.14.4': + '@grpc/grpc-js@1.14.5': dependencies: '@grpc/proto-loader': 0.8.1 '@js-sdsl/ordered-map': 4.4.2 @@ -10292,16 +10297,16 @@ snapshots: bowser@2.14.1: {} - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -10715,7 +10720,7 @@ snapshots: dockerode@5.0.1(supports-color@7.2.0): dependencies: '@balena/dockerignore': 1.0.2 - '@grpc/grpc-js': 1.14.4 + '@grpc/grpc-js': 1.14.5 '@grpc/proto-loader': 0.7.15 docker-modem: 5.0.7(supports-color@7.2.0) protobufjs: 7.6.5 @@ -12121,19 +12126,19 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimist@1.2.8: {} @@ -13176,7 +13181,7 @@ snapshots: tailwind-merge: 3.6.0 ts-morph: 26.0.0 tsconfig-paths: 4.2.0 - undici: 7.29.0 + undici: 7.30.0 validate-npm-package-name: 7.0.2 zod: 3.25.76 zod-to-json-schema: 3.25.2(zod@3.25.76) @@ -13705,7 +13710,7 @@ snapshots: undici-types@8.9.0: {} - undici@7.29.0: {} + undici@7.30.0: {} undici@8.11.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e1f9d705d..d1e045b06 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -83,6 +83,15 @@ overrides: # patched line is the same minor, so nothing downstream moves. "esbuild@>=0.27.3 <0.28.1": "^0.28.1" + # Development-only copies (test containers, build tooling) that the + # dependency alerts flag: gRPC under the test containers, brace-expansion on + # three major lines, and undici 7 next to the app's own undici 8. + "@grpc/grpc-js@>=1.14.0 <1.14.5": "^1.14.5" + "brace-expansion@<1.1.21": "^1.1.21" + "brace-expansion@>=2.0.0 <2.1.7": "^2.1.7" + "brace-expansion@>=4.0.0 <5.0.12": "^5.0.12" + "undici@>=7.0.0 <7.29.1": "^7.29.1" + allowBuilds: "@prisma/engines": true prisma: true diff --git a/prisma/migrations/0364_data_backup_preview/migration.sql b/prisma/migrations/0364_data_backup_preview/migration.sql new file mode 100644 index 000000000..fb1653bd7 --- /dev/null +++ b/prisma/migrations/0364_data_backup_preview/migration.sql @@ -0,0 +1,5 @@ +-- What the restore preview shows for a stored backup, worked out while the +-- copy is written, so the preview no longer reads the whole copy inside a web +-- request. Nullable: a copy written before this release has none until its +-- first preview has read it once. +ALTER TABLE "data_backups" ADD COLUMN IF NOT EXISTS "preview" JSONB; diff --git a/prisma/schema.prisma b/prisma/schema.prisma index f570c28b1..11b59cb98 100644 --- a/prisma/schema.prisma +++ b/prisma/schema.prisma @@ -5032,6 +5032,18 @@ model DataBackup { /// Whether `innerKeyIds` was recorded; false on every copy written before /// v1.39.3. Consumer: the same status read (`backups.unrecorded`). innerKeyIdsRecorded Boolean @default(false) @map("inner_key_ids_recorded") + /// What the restore preview shows for this copy, worked out while the copy + /// was written (`src/lib/export/backup-preview.ts`): the section counts, the + /// schema version, and the inner key ids with the sections they sit in and + /// one sample value each, so the key verdict is taken again against this + /// server's keys every time it is read. It names the copy it describes and + /// is ignored once the copy changes. Plain JSON on purpose: counts and dates + /// only, and the samples are ciphertext already, which a key rotation must + /// not re-seal because they stand for what is inside the copy. NULL for a + /// copy written before this column existed, until its first preview has + /// read it whole. + /// Consumer: `GET /api/admin/backups/{id}/summary`. + preview Json? createdAt DateTime @default(now()) @map("created_at") user User @relation(fields: [userId], references: [id], onDelete: Cascade) diff --git a/src/__tests__/bearer-scope-enforcement-guard.test.ts b/src/__tests__/bearer-scope-enforcement-guard.test.ts index 301a57130..5b2562c98 100644 --- a/src/__tests__/bearer-scope-enforcement-guard.test.ts +++ b/src/__tests__/bearer-scope-enforcement-guard.test.ts @@ -152,6 +152,9 @@ describe("T3 — the mint sites are frozen", () => { // Document upload from another system (#1038). Same shape as the // measurement mint: a literal, one scope, one route that accepts it. "app/api/tokens/documents/route.ts": "[DOCUMENTS_WRITE_SCOPE]", + // Workout ingest from a bridge (#1054). Same shape again: a literal, one + // scope, one route that accepts it. + "app/api/tokens/workouts/route.ts": "[WORKOUTS_WRITE_SCOPE]", // MCP, audience-bound to `/mcp`. `health:write` requires explicit consent. "app/api/mcp/tokens/route.ts": "SCOPE_HEALTH_READ / SCOPE_HEALTH_WRITE", "app/api/mcp/oauth/token/route.ts": @@ -179,6 +182,7 @@ describe("T3 — the mint sites are frozen", () => { "app/api/medications/[id]/api-endpoint/route.ts", "app/api/tokens/measurements/route.ts", "app/api/tokens/documents/route.ts", + "app/api/tokens/workouts/route.ts", "app/api/mcp/tokens/route.ts", "app/api/mcp/oauth/token/route.ts", ]; @@ -234,6 +238,7 @@ describe("T4 — declared scopes are exported constants, never string literals", "DOCUMENTS_WRITE_SCOPE", "FHIR_READ_SCOPE", "MEASUREMENTS_WRITE_SCOPE", + "WORKOUTS_WRITE_SCOPE", ]; const used = new Set(); for (const rel of sourceFiles()) { @@ -284,6 +289,27 @@ describe("T4b — `documents:write` opens exactly two doors", () => { }); }); +describe("T4c — `workouts:write` opens exactly one door", () => { + it("only the workout batch declares the scope, and only on its POST", () => { + // The set of files naming the scope IS its reach. The batch ingest and + // nothing else: not the workout list or detail, which would hand a + // bridge the history it has no business reading back. + const declaring = filesMatching( + /requireAuth\(\s*WORKOUTS_WRITE_SCOPE\s*\)|requireRecordAuth\([^)]*\bscope:\s*WORKOUTS_WRITE_SCOPE\b/, + ); + expect(declaring).toEqual(["app/api/workouts/batch/route.ts"]); + const batch = read("app/api/workouts/batch/route.ts"); + expect( + batch.match(/requireAuth\(\s*WORKOUTS_WRITE_SCOPE\s*\)/g), + ).toHaveLength(1); + expect( + [...batch.matchAll(/export const (GET|POST|PUT|PATCH|DELETE)\b/g)].map( + (m) => m[1], + ), + ).toEqual(["POST"]); + }); +}); + describe("T5 — a delegable route naming a Bearer scope is frozen", () => { /** * Routes that admit a narrow token on a DELEGABLE surface, and the scope each diff --git a/src/__tests__/recent-proof-surface-guard.test.ts b/src/__tests__/recent-proof-surface-guard.test.ts index bb334ff98..4c818ed17 100644 --- a/src/__tests__/recent-proof-surface-guard.test.ts +++ b/src/__tests__/recent-proof-surface-guard.test.ts @@ -114,6 +114,7 @@ const COOKIE_PROOF_ROUTES = [ "app/api/auth/reproof/route.ts", "app/api/tokens/documents/route.ts", "app/api/tokens/measurements/route.ts", + "app/api/tokens/workouts/route.ts", ].sort(); describe("the recent-proof gate", () => { diff --git a/src/app/api/admin/backups/[id]/summary/__tests__/route.test.ts b/src/app/api/admin/backups/[id]/summary/__tests__/route.test.ts index f796b4b36..9c95d3f8b 100644 --- a/src/app/api/admin/backups/[id]/summary/__tests__/route.test.ts +++ b/src/app/api/admin/backups/[id]/summary/__tests__/route.test.ts @@ -1,11 +1,14 @@ /** - * v1.37.20 — restore preview: the summary read decrypts and validates the - * stored file through the SAME helpers the restore uses, and only ever - * reads. Watched red: written against the route before its annotate landed; - * the not-found and decrypt-failure arms were asserted first. + * Restore preview. A copy written with a preview is answered from it without + * opening the copy (#1031); a copy from before previews is read whole once, + * through the same helpers the restore uses, and what that read found is kept + * on the row. The verdicts (schema version, keys) are taken again on every + * read. Only a file that fails the schema is a 422 with that message; any + * other failure is the server's, not the file's. */ import { describe, it, expect, vi, beforeEach } from "vitest"; import { NextRequest } from "next/server"; +import { ZodError } from "zod/v4"; vi.mock("@/lib/api-handler", () => ({ apiHandler: unknown>(fn: T) => fn, @@ -23,9 +26,15 @@ vi.mock("@/lib/api-handler", () => ({ vi.mock("@/lib/logging/context", () => ({ annotate: vi.fn() })); const findUniqueMock = vi.fn(); +const updateManyMock = vi.fn(); +const chunkCountMock = vi.fn(); vi.mock("@/lib/db", () => ({ prisma: { - dataBackup: { findUnique: (...a: unknown[]) => findUniqueMock(...a) }, + dataBackup: { + findUnique: (...a: unknown[]) => findUniqueMock(...a), + updateMany: (...a: unknown[]) => updateManyMock(...a), + }, + dataBackupChunk: { count: (...a: unknown[]) => chunkCountMock(...a) }, }, })); @@ -34,16 +43,32 @@ const decryptMock = vi.fn(); // decrypts anything, so a stub of this module has to answer that too. vi.mock("@/lib/crypto", () => ({ decrypt: (...a: unknown[]) => decryptMock(...a), + decryptBytes: vi.fn(), + getConfiguredKeyIds: () => ["v1"], isStreamCiphertext: () => false, decryptStream: vi.fn(), })); +const openSpy = vi.fn(); +vi.mock("@/lib/export/stored-backup", async (importOriginal) => { + const actual = + await importOriginal(); + return { + ...actual, + openStoredBackup: (...a: Parameters) => { + openSpy(...a); + return actual.openStoredBackup(...a); + }, + }; +}); + const parseMock = vi.fn(); const summarizeMock = vi.fn(); +const compatibleMock = vi.fn((version: string) => version !== "99"); vi.mock("@/lib/validations/backup", () => ({ parseBackupPayload: (...a: unknown[]) => parseMock(...a), summarizeBackup: (...a: unknown[]) => summarizeMock(...a), - isCompatibleSchemaVersion: vi.fn(() => true), + isCompatibleSchemaVersion: (version: string) => compatibleMock(version), // The measurements are read as a stream and counted one by one. BACKUP_SCHEMA_VERSION: "2", backupMeasurementSchema: { @@ -52,52 +77,201 @@ vi.mock("@/lib/validations/backup", () => ({ })); import { GET } from "../route"; +import { storedCopyIdentity } from "@/lib/export/backup-preview"; const request = new NextRequest( "http://localhost/api/admin/backups/b1/summary", ); -const params = { params: Promise.resolve({ id: "b1" }) }; +const params = () => ({ params: Promise.resolve({ id: "b1" }) }); + +const ROW = { + id: "b1", + userId: "u1", + data: "ciphertext", + chunkCount: null, + chunkStreamId: null, + createdAt: new Date("2026-08-01T00:00:00Z"), + user: { id: "u1", username: "self-hoster" }, +}; + +function storedPreview(overrides: Record = {}) { + return { + version: 1, + copy: storedCopyIdentity(ROW), + summary: { + schemaVersion: "2", + userId: "u1", + exportedAt: "2026-08-01T00:00:00.000Z", + measurements: 1_800_000, + moodEntries: 3, + }, + keys: [], + ...overrides, + }; +} beforeEach(() => { vi.clearAllMocks(); - findUniqueMock.mockResolvedValue({ - id: "b1", - userId: "u1", - data: "ciphertext", - chunkCount: null, - chunkStreamId: null, - createdAt: new Date("2026-08-01T00:00:00Z"), - user: { id: "u1", username: "self-hoster" }, - }); + findUniqueMock.mockResolvedValue({ ...ROW, preview: null }); + updateManyMock.mockResolvedValue({ count: 1 }); // Twelve measurements in the file: the preview counts them from the stream. decryptMock.mockReturnValue( JSON.stringify({ measurements: Array.from({ length: 12 }, (_, i) => ({ id: `m${i}` })), }), ); - parseMock.mockReturnValue({ schemaVersion: 3 }); - summarizeMock.mockReturnValue({ measurements: 0, moodEntries: 3 }); + parseMock.mockReturnValue({ schemaVersion: "2" }); + summarizeMock.mockReturnValue({ + schemaVersion: "2", + userId: "u1", + exportedAt: "2026-08-01T00:00:00.000Z", + measurements: 0, + moodEntries: 3, + }); }); -describe("GET /api/admin/backups/[id]/summary", () => { - it("answers the file's counts without writing anything", async () => { - const res = await GET(request, params); +describe("GET /api/admin/backups/[id]/summary, from the stored preview", () => { + it("answers from the preview without opening the copy", async () => { + findUniqueMock.mockResolvedValue({ ...ROW, preview: storedPreview() }); + const res = await GET(request, params()); expect(res.status).toBe(200); const body = await res.json(); - expect(body.data.summary).toEqual({ measurements: 12, moodEntries: 3 }); + expect(body.data.summary).toMatchObject({ + measurements: 1_800_000, + moodEntries: 3, + }); expect(body.data.owner).toBe("self-hoster"); + expect(openSpy).not.toHaveBeenCalled(); + expect(decryptMock).not.toHaveBeenCalled(); + expect(updateManyMock).not.toHaveBeenCalled(); + }); + + it("takes the schema verdict again against this release", async () => { + findUniqueMock.mockResolvedValue({ + ...ROW, + preview: storedPreview({ + summary: { + schemaVersion: "99", + userId: "u1", + exportedAt: "2026-08-01T00:00:00.000Z", + measurements: 1, + }, + }), + }); + const res = await GET(request, params()); + expect(res.status).toBe(422); + expect(openSpy).not.toHaveBeenCalled(); + }); + + it("takes the key verdict again against this server's keys", async () => { + findUniqueMock.mockResolvedValue({ + ...ROW, + preview: storedPreview({ + keys: [ + { + keyId: "v7", + count: 4, + sections: ["moodEntries"], + sample: { value: "v7.AAAA", form: "string" }, + }, + // Only in the instance settings, which the restore leaves out. + { + keyId: "v8", + count: 1, + sections: ["appSettings"], + sample: null, + }, + ], + }), + }); + const res = await GET(request, params()); + expect(res.status).toBe(422); + expect(await res.json()).toMatchObject({ + meta: { errorCode: "backup.key.missing", keyIds: ["v7"] }, + }); + expect(openSpy).not.toHaveBeenCalled(); + }); + + it("still counts the pieces, and refuses a copy that lost one", async () => { + const chunked = { + ...ROW, + data: null, + chunkCount: 3, + chunkStreamId: "s1", + }; + findUniqueMock.mockResolvedValue({ + ...chunked, + preview: storedPreview({ copy: storedCopyIdentity(chunked) }), + }); + chunkCountMock.mockResolvedValue(3); + expect((await GET(request, params())).status).toBe(200); + + chunkCountMock.mockResolvedValue(2); + const res = await GET(request, params()); + expect(res.status).toBe(422); + expect(await res.json()).toMatchObject({ + meta: { errorCode: "backup.payload.undecryptable" }, + }); + expect(openSpy).not.toHaveBeenCalled(); + }); + + it("ignores a preview that describes another copy", async () => { + findUniqueMock.mockResolvedValue({ + ...ROW, + preview: storedPreview({ copy: "chunks:other:3" }), + }); + const res = await GET(request, params()); + expect(res.status).toBe(200); + expect((await res.json()).data.summary.measurements).toBe(12); + expect(openSpy).toHaveBeenCalledTimes(1); + }); +}); + +describe("GET /api/admin/backups/[id]/summary, a copy without a preview", () => { + it("reads the copy once and keeps what it found on the row", async () => { + const res = await GET(request, params()); + expect(res.status).toBe(200); + const body = await res.json(); + expect(body.data.summary).toMatchObject({ + measurements: 12, + moodEntries: 3, + }); + expect(openSpy).toHaveBeenCalledTimes(1); + await vi.waitFor(() => expect(updateManyMock).toHaveBeenCalledTimes(1)); + const [call] = updateManyMock.mock.calls[0] as [ + { where: Record; data: { preview: { copy: string } } }, + ]; + // Only onto the copy it was read from. + expect(call.where).toEqual({ + id: "b1", + chunkStreamId: null, + chunkCount: null, + }); + expect(call.data.preview.copy).toBe(storedCopyIdentity(ROW)); + }); + + it("shares one read between requests for the same copy", async () => { + const [a, b] = await Promise.all([ + GET(request, params()), + GET(request, params()), + ]); + expect(a.status).toBe(200); + expect(b.status).toBe(200); + expect(openSpy).toHaveBeenCalledTimes(1); }); it("404s an unknown backup id", async () => { findUniqueMock.mockResolvedValue(null); - await expect(GET(request, params)).rejects.toMatchObject({ status: 404 }); + await expect(GET(request, params())).rejects.toMatchObject({ + status: 404, + }); }); it("refuses a file it cannot decrypt with the documented 422", async () => { decryptMock.mockImplementation(() => { throw new Error("bad key"); }); - const res = await GET(request, params); + const res = await GET(request, params()); // Bad stored input — a key dropped from `ENCRYPTION_KEYS`, or bytes that // are not the ones written — and not a fault in this process, so it does // not answer 500 and does not reach the error reporter as one. @@ -105,13 +279,42 @@ describe("GET /api/admin/backups/[id]/summary", () => { expect(await res.json()).toMatchObject({ meta: { errorCode: "backup.payload.undecryptable" }, }); + expect(updateManyMock).not.toHaveBeenCalled(); }); it("422s a file that fails schema validation", async () => { parseMock.mockImplementation(() => { - throw new Error("nope"); + throw new ZodError([]); }); - const res = await GET(request, params); + const res = await GET(request, params()); expect(res.status).toBe(422); + expect((await res.json()).error).toBe( + "Backup payload failed schema validation", + ); + expect(updateManyMock).not.toHaveBeenCalled(); + }); + + it("422s a file that is not JSON", async () => { + decryptMock.mockReturnValue("{ not json"); + const res = await GET(request, params()); + expect(res.status).toBe(422); + expect((await res.json()).error).toBe( + "Backup payload failed schema validation", + ); + }); + + it("does not call a server failure a schema failure", async () => { + parseMock.mockImplementation(() => { + throw new Error("out of memory"); + }); + // Thrown to the handler, which answers 500 and reports it. + await expect(GET(request, params())).rejects.toThrow("out of memory"); + expect(updateManyMock).not.toHaveBeenCalled(); + }); + + it("still answers when keeping the preview fails", async () => { + updateManyMock.mockRejectedValue(new Error("db gone")); + const res = await GET(request, params()); + expect(res.status).toBe(200); }); }); diff --git a/src/app/api/admin/backups/[id]/summary/route.ts b/src/app/api/admin/backups/[id]/summary/route.ts index b1499a1ed..36862e792 100644 --- a/src/app/api/admin/backups/[id]/summary/route.ts +++ b/src/app/api/admin/backups/[id]/summary/route.ts @@ -4,33 +4,57 @@ * * The restore dialog used to ask for the typed confirmation on nothing but * a filename and a date; the counts only appeared in the audit row after - * the rows were already replaced. This read decrypts and schema-validates - * the stored file exactly the way the restore itself does (same decrypt, - * same `parseBackupPayload`, same compatibility gate) and answers with the - * `summarizeBackup` counts — so what the operator confirms is what the - * restore will write, derived from the same code path. Read-only; nothing - * is touched. + * the rows were already replaced. This answers with the `summarizeBackup` + * counts of the stored copy, and refuses the way the restore would refuse: + * a schema version this release cannot restore, or a key the copy's inner + * ciphertext needs and this server does not have. + * + * The counts are worked out while the copy is written and kept on its row + * (`DataBackup.preview`, `src/lib/export/backup-preview.ts`), so this answers + * without opening the copy. Reading the copy here took two minutes for an + * account of 1.8 million readings on slow hardware, long after the dialog had + * given up (#1031). Both verdicts are taken again on every read, from what + * the preview keeps, because the release and the server's keys can both + * change after the copy was written. The copy's pieces are still counted + * against the row (no piece is read), so a copy that lost one since is + * refused here, as the restore and the download refuse it. + * + * A copy written before previews existed has none. That one is read whole, + * once: the preview worked out from it is stored on the row, so the next + * request answers at once, and concurrent requests for the same copy share + * the one read. */ import { NextRequest } from "next/server"; +import { ZodError } from "zod/v4"; +import { Prisma } from "@/generated/prisma/client"; import { prisma } from "@/lib/db"; import { apiHandler, HttpError, requireAdmin } from "@/lib/api-handler"; import { apiError, apiSuccess } from "@/lib/api-response"; import { + checkStoredBackupShape, isStoredBackupReadError, openStoredBackup, storedBackupRefusal, STORED_BACKUP_SELECT, + type StoredBackupRef, } from "@/lib/export/stored-backup"; import { assessBackupKeys, BACKUP_KEY_MISSING_CODE, + BackupKeyIdCollector, describeBackupKeyProblem, } from "@/lib/export/backup-key-ids"; +import { BackupJsonError } from "@/lib/export/backup-json-scan"; +import { + buildBackupPreview, + storedCopyIdentity, + storedPreviewFor, + type BackupPreview, +} from "@/lib/export/backup-preview"; import { readStreamedBackup, - type BackupSource, - type StreamedBackup, + StreamedBackupInvalidError, } from "@/lib/export/streamed-backup"; import { annotate } from "@/lib/logging/context"; import { @@ -43,6 +67,114 @@ export const dynamic = "force-dynamic"; type RouteParams = { params: Promise<{ id: string }> }; +/** Why a copy could not be summarised, as the route answers it. */ +type Refusal = { status: number; message: string; code?: string }; + +type ReadOutcome = { preview: BackupPreview } | { refusal: Refusal }; + +/** + * Reads of a copy without a preview that are running now, by copy. A second + * request for the same copy (the dialog opened again while the first read is + * still going) waits for the first instead of reading it all again. + */ +const inFlight = new Map>(); + +/** Whether a failure is the file itself not being a backup this reads. */ +function isPayloadInvalid(err: unknown): boolean { + return ( + err instanceof BackupJsonError || + err instanceof StreamedBackupInvalidError || + err instanceof ZodError + ); +} + +/** + * Read a copy whole and work out its preview: the way every preview was + * taken before previews were stored. Throws for anything that is neither a + * read refusal nor a file that fails the schema, which the handler answers + * as a server fault. + */ +async function readPreview( + backup: StoredBackupRef, + copy: string, +): Promise { + const refused = (err: unknown): ReadOutcome => { + const refusal = storedBackupRefusal(err); + return { + refusal: { + status: refusal.status, + message: refusal.message, + code: refusal.code, + }, + }; + }; + + // Opened and read as a stream: a large record's JSON is longer than any + // string V8 can hold (#1031). + let source; + try { + source = await openStoredBackup(prisma, backup); + } catch (err) { + // Same refusal the restore and the download give, for the same reason: + // a copy this instance cannot open is bad stored input, and the preview + // is the first place an operator meets it. + return refused(err); + } + + try { + const streamed = await readStreamedBackup(source); + const payload = parseBackupPayload(streamed.raw); + const summary = { + ...summarizeBackup(payload), + measurements: streamed.measurementCount, + }; + return { preview: buildBackupPreview(copy, summary, streamed.keys) }; + } catch (err) { + if (isStoredBackupReadError(err)) return refused(err); + // Only a file that is not a backup this release reads is a 422. Anything + // else is this server failing, not the file, and is answered as such. + if (isPayloadInvalid(err)) { + return { + refusal: { + status: 422, + message: "Backup payload failed schema validation", + }, + }; + } + throw err; + } +} + +/** + * Keep a preview worked out by reading the copy, so the next request answers + * without reading it. Written only while the row still holds the copy it was + * read from; a failure here costs the next request the same read, nothing + * more, so it is noted and not raised. + */ +async function keepPreview( + backup: StoredBackupRef, + preview: BackupPreview, +): Promise { + try { + await prisma.dataBackup.updateMany({ + where: { + id: backup.id, + chunkStreamId: backup.chunkStreamId, + chunkCount: backup.chunkCount, + }, + data: { preview: preview as unknown as Prisma.InputJsonValue }, + }); + } catch (err) { + annotate({ + action: { name: "admin.backups.summary.keep_failed" }, + meta: { + backupId: backup.id, + error: err instanceof Error ? err.name : "unknown", + }, + }); + } +} + export const GET = apiHandler( async (_request: NextRequest, { params }: RouteParams) => { const { user: admin } = await requireAdmin(); @@ -53,6 +185,7 @@ export const GET = apiHandler( where: { id }, select: { ...STORED_BACKUP_SELECT, + preview: true, createdAt: true, user: { select: { id: true, username: true } }, }, @@ -61,41 +194,58 @@ export const GET = apiHandler( throw new HttpError(404, "Backup not found"); } - // Opened and read as a stream: a large record's JSON is longer than any - // string V8 can hold (#1031). - let source: BackupSource; - try { - source = await openStoredBackup(prisma, backup); - } catch (err) { - // Same refusal the restore and the download give, for the same reason: - // a copy this instance cannot open is bad stored input, and the preview - // is the first place an operator meets it. - const refusal = storedBackupRefusal(err); - return apiError(refusal.message, refusal.status, { - errorCode: refusal.code, - }); - } - - let payload; - let measurementCount: number; - let streamed: StreamedBackup; - try { - streamed = await readStreamedBackup(source); - measurementCount = streamed.measurementCount; - payload = parseBackupPayload(streamed.raw); - } catch (err) { - if (isStoredBackupReadError(err)) { + let preview = storedPreviewFor(backup.preview, backup); + const fromStore = preview !== null; + if (preview) { + // The counts were kept; the copy's pieces are still counted, so a copy + // that lost one since is refused here as the restore would refuse it. + // Tampering inside a piece is found by the restore's own open, before + // it deletes anything. + try { + await checkStoredBackupShape(prisma, backup); + } catch (err) { + if (!isStoredBackupReadError(err)) throw err; const refusal = storedBackupRefusal(err); - return apiError(refusal.message, refusal.status, { - errorCode: refusal.code, + return refusalResponse({ + status: refusal.status, + message: refusal.message, + code: refusal.code, }); } - return apiError("Backup payload failed schema validation", 422); + } + if (!preview) { + const copy = storedCopyIdentity(backup); + if (copy === null) { + // A row holding both forms, or neither: the open refuses it, with + // the reason. + const outcome = await readPreview(backup, ""); + if ("refusal" in outcome) return refusalResponse(outcome.refusal); + throw new Error("A stored backup with no nameable copy was read"); + } + const flight = `${backup.id}:${copy}`; + let pending = inFlight.get(flight); + if (!pending) { + pending = readPreview(backup, copy).finally(() => { + inFlight.delete(flight); + }); + inFlight.set(flight, pending); + // Kept whatever the verdicts below say: they are taken again on + // every read, and the counts do not change. + void pending.then( + (outcome) => + "preview" in outcome ? keepPreview(backup, outcome.preview) : null, + () => null, + ); + } + const outcome = await pending; + if ("refusal" in outcome) return refusalResponse(outcome.refusal); + preview = outcome.preview; } - if (!isCompatibleSchemaVersion(payload.schemaVersion)) { + const { summary } = preview; + if (!isCompatibleSchemaVersion(summary.schemaVersion)) { return apiError( - `Backup schema version ${payload.schemaVersion} is not restorable by this release`, + `Backup schema version ${summary.schemaVersion} is not restorable by this release`, 422, ); } @@ -105,9 +255,10 @@ export const GET = apiHandler( // does not have. The instance settings are left out here, as the restore // leaves them out unless asked; the restore itself checks them when they // are asked for. - const keyVerdict = assessBackupKeys(streamed.keys, { - ignoreSections: new Set(["appSettings"]), - }); + const keyVerdict = assessBackupKeys( + BackupKeyIdCollector.fromStored(preview.keys), + { ignoreSections: new Set(["appSettings"]) }, + ); const keyProblem = describeBackupKeyProblem(keyVerdict); if (keyProblem) { return apiError(keyProblem, 422, { @@ -116,14 +267,9 @@ export const GET = apiHandler( }); } - const summary = { - ...summarizeBackup(payload), - measurements: measurementCount, - }; - annotate({ action: { name: "admin.backups.summary" }, - meta: { backupId: id, ownerId: backup.userId }, + meta: { backupId: id, ownerId: backup.userId, fromStore }, }); return apiSuccess({ @@ -133,3 +279,11 @@ export const GET = apiHandler( }); }, ); + +function refusalResponse(refusal: Refusal) { + return apiError( + refusal.message, + refusal.status, + refusal.code ? { errorCode: refusal.code } : undefined, + ); +} diff --git a/src/app/api/measurements/series/__tests__/route.test.ts b/src/app/api/measurements/series/__tests__/route.test.ts index de6f8dced..cd220128a 100644 --- a/src/app/api/measurements/series/__tests__/route.test.ts +++ b/src/app/api/measurements/series/__tests__/route.test.ts @@ -631,6 +631,85 @@ describe("GET /api/measurements/series — dense-kind day-bucketing (v1.28.25)", expect(bucketSql.slice(1)).toContain("hour"); }); + it("hour-buckets a CGM glucose window too dense to send raw, in the user's unit", async () => { + vi.mocked(getSession).mockResolvedValue(SESSION_OK as never); + vi.mocked(prisma.user.findUnique).mockResolvedValue({ + glucoseUnit: "mmol/L", + } as never); + // A sensor reading every five minutes for 90 days. + vi.mocked(prisma.measurement.count).mockResolvedValue(25_920 as never); + vi.mocked(prisma.$queryRaw) + .mockResolvedValueOnce([ + { + bucket_start: new Date("2026-06-01T08:00:00Z"), + mean: 100, + min_value: 90, + max_value: 112, + }, + ] as never) + .mockResolvedValueOnce([ + { n: 25_920, mean: 118.004, min: 48, max: 260, sd: 36.004 }, + ] as never); + + const res = await GET(req("kind=glucose&days=90")); + expect(res.status).toBe(200); + const body = (await res.json()) as { + data: { + unit: string; + points: Array>; + stats: { + count: number; + mean: number; + min: number; + max: number; + stdDev: number; + }; + }; + }; + expect(prisma.measurement.findMany).not.toHaveBeenCalled(); + expect(vi.mocked(prisma.measurement.count).mock.calls[0]?.[0]).toEqual( + expect.objectContaining({ + where: expect.objectContaining({ type: "BLOOD_GLUCOSE" }), + }), + ); + expect(body.data.unit).toBe("mmol/L"); + // Converted once at serialization; no band on a glucose point. + expect(body.data.points).toEqual([ + { + id: "hour:2026-06-01T08:00:00.000Z", + at: "2026-06-01T08:00:00.000Z", + value: 5.5, + secondary: null, + }, + ]); + // Stats describe every reading (mg/dL aggregate, converted once). + expect(body.data.stats).toEqual({ + count: 25_920, + mean: 6.5, + min: 2.7, + max: 14.4, + stdDev: 2, + }); + const bucketSql = vi.mocked(prisma.$queryRaw).mock.calls[0] as unknown[]; + expect(bucketSql.slice(1)).toContain("hour"); + }); + + it("keeps fingerstick glucose at or under the row cap raw", async () => { + vi.mocked(getSession).mockResolvedValue(SESSION_OK as never); + vi.mocked(prisma.measurement.count).mockResolvedValue(360 as never); + vi.mocked(prisma.measurement.findMany).mockResolvedValue([ + { id: "g1", value: 104, measuredAt: new Date("2026-06-01T07:12:00Z") }, + ] as never); + const res = await GET(req("kind=glucose&days=90")); + const body = (await res.json()) as { + data: { points: Array> }; + }; + expect(prisma.$queryRaw).not.toHaveBeenCalled(); + expect(body.data.points).toEqual([ + { id: "g1", at: "2026-06-01T07:12:00.000Z", value: 104, secondary: null }, + ]); + }); + it("keeps a pulse window at or under the row cap raw", async () => { vi.mocked(getSession).mockResolvedValue(SESSION_OK as never); vi.mocked(prisma.measurement.count).mockResolvedValue(10_000 as never); diff --git a/src/app/api/measurements/series/route.ts b/src/app/api/measurements/series/route.ts index 80d5ed035..06d46e07a 100644 --- a/src/app/api/measurements/series/route.ts +++ b/src/app/api/measurements/series/route.ts @@ -52,17 +52,20 @@ const DENSE_SERIES_RAW_WINDOW_DAYS = 90; const DENSE_SERIES_KINDS: ReadonlySet = new Set(["glucose", "pulse"]); /** - * #1023 — inside the raw window, a pulse series with more rows than this is - * bucketed per local hour in SQL instead of sent raw. + * #1023 — inside the raw window, a pulse or glucose series with more rows + * than this is bucketed per local hour in SQL instead of sent raw. * * A watch that records heart rate once a minute puts 43 000 rows in the * default 30-day window and 130 000 in 90 days: a 15 MB response the client * could not draw at that resolution anyway, built from as many objects on the - * server. Hourly buckets carry the hour's mean with its low/high band, the - * shape an hourly-bucket import already has, and cap the answer at 24 points - * a day. The cap sits far above what sparse sources produce (a cuff, hourly - * buckets over 90 days, a watch sampling every five minutes over 30 days), so - * those series stay raw and unchanged. + * server. A CGM reading every five minutes puts 26 000 glucose rows in 90 + * days, the same problem at a smaller scale. Hourly buckets carry the hour's + * mean (pulse also its low/high band, the shape an hourly-bucket import + * already has) and cap the answer at 24 points a day; the statistics stay + * computed over every raw reading. The cap sits far above what sparse sources + * produce (a cuff, fingerstick glucose, hourly buckets over 90 days, a watch + * sampling every five minutes over 30 days), so those series stay raw and + * unchanged. */ const DENSE_SERIES_RAW_ROW_CAP = 10_000; @@ -368,18 +371,18 @@ export const GET = apiHandler(async (request: NextRequest) => { }); } else if ( (DENSE_SERIES_KINDS.has(kind) && days > DENSE_SERIES_RAW_WINDOW_DAYS) || - (kind === "pulse" && + (DENSE_SERIES_KINDS.has(kind) && (await prisma.measurement.count({ where: { userId: user.id, - type: "PULSE", + type: KIND_TO_TYPE[kind], measuredAt: { gte: since }, deletedAt: null, }, })) > DENSE_SERIES_RAW_ROW_CAP) ) { - // Day buckets past the raw window; hour buckets for a pulse stream too - // dense to send raw inside it. + // Day buckets past the raw window; hour buckets for a pulse or CGM + // stream too dense to send raw inside it. const grain = days > DENSE_SERIES_RAW_WINDOW_DAYS ? "day" : "hour"; // v1.28.25 — long-window read of a sample-dense kind (CGM glucose, // per-sample / hourly pulse). Day-bucket in SQL instead of walking diff --git a/src/app/api/tokens/workouts/__tests__/route.test.ts b/src/app/api/tokens/workouts/__tests__/route.test.ts new file mode 100644 index 000000000..e8f722929 --- /dev/null +++ b/src/app/api/tokens/workouts/__tests__/route.test.ts @@ -0,0 +1,245 @@ +/** + * The workout-ingest mint (#1054). + * + * The assertion that matters most is not the 201 — it is the exact + * `permissions` array handed to `issueApiToken`. That helper defaults to + * `["*"]` when the property is absent, so an edit that drops one line turns a + * user-facing endpoint into a cookie-equivalent credential factory, and a test + * that only checked the status code would go on passing. The structural guard + * catches a literal `permissions: ["*"` and would not catch the omission, so + * this is where that hole is closed. + */ +import { describe, it, expect, vi, beforeEach } from "vitest"; + +vi.mock("@/lib/api-handler", () => ({ + apiHandler: (fn: unknown) => fn, + requireCookieAuth: vi.fn(), + assertRecentCookieProof: vi.fn(), +})); + +vi.mock("@/lib/auth/issue-token", () => ({ + issueApiToken: vi.fn(), +})); + +vi.mock("@/lib/app-settings", () => ({ + isApiGloballyEnabled: vi.fn(), +})); + +vi.mock("@/lib/rate-limit", () => ({ + checkRateLimit: vi.fn(), +})); + +vi.mock("@/lib/auth/audit", () => ({ + auditLog: vi.fn().mockResolvedValue(undefined), +})); + +vi.mock("@/lib/logging/context", () => ({ + annotate: vi.fn(), + getEvent: vi.fn(() => null), +})); + +vi.mock("@/lib/db", () => ({ + prisma: { apiToken: { count: vi.fn() } }, +})); + +import { POST } from "../route"; +import { assertRecentCookieProof, requireCookieAuth } from "@/lib/api-handler"; +import { issueApiToken } from "@/lib/auth/issue-token"; +import { isApiGloballyEnabled } from "@/lib/app-settings"; +import { checkRateLimit } from "@/lib/rate-limit"; +import { auditLog } from "@/lib/auth/audit"; +import { prisma } from "@/lib/db"; +import { WORKOUTS_WRITE_SCOPE } from "@/lib/workouts/scopes"; + +const USER = { id: "user-1", role: "USER" as const }; +const EXPIRES = new Date("2027-08-31T00:00:00.000Z"); + +function req(body: unknown): Request { + return new Request("https://health.example/api/tokens/workouts", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify(body), + }); +} + +beforeEach(() => { + vi.resetAllMocks(); + vi.mocked(requireCookieAuth).mockResolvedValue({ + user: USER, + session: { id: "sess-1" }, + } as never); + vi.mocked(assertRecentCookieProof).mockResolvedValue(undefined); + vi.mocked(isApiGloballyEnabled).mockResolvedValue(true); + vi.mocked(checkRateLimit).mockResolvedValue({ allowed: true } as never); + vi.mocked(auditLog).mockResolvedValue(undefined as never); + // Below the ceiling by default; the cases that care set their own count. + vi.mocked(prisma.apiToken.count).mockResolvedValue(0 as never); + vi.mocked(issueApiToken).mockResolvedValue({ + token: "hlk_" + "a".repeat(64), + expiresAt: EXPIRES, + tokenId: "token-1", + name: "Watch bridge", + } as never); +}); + +describe("the fresh proof in front of the mint", () => { + it("mints nothing when the session carries no recent proof", async () => { + vi.mocked(assertRecentCookieProof).mockRejectedValue( + new Error("auth.reproof.required"), + ); + await expect(POST(req({ name: "Scale" }) as never)).rejects.toThrow( + "auth.reproof.required", + ); + expect(issueApiToken).not.toHaveBeenCalled(); + }); + + it("asks about the caller's own session", async () => { + await POST(req({ name: "Scale" }) as never); + expect(assertRecentCookieProof).toHaveBeenCalledWith( + expect.objectContaining({ id: expect.any(String) }), + "sess-1", + ); + }); +}); + +describe("what it mints", () => { + it("names exactly the workout scope, and no wildcard", async () => { + const res = await POST(req({ name: "Watch bridge" }) as never); + expect(res.status).toBe(201); + + const opts = vi.mocked(issueApiToken).mock.calls[0][0]; + // Exact equality, not `toContain`: an extra scope is a widening, and this + // is the assertion standing between the endpoint and one. + expect(opts.permissions).toEqual([WORKOUTS_WRITE_SCOPE]); + expect(opts.userId).toBe(USER.id); + }); + + it("returns the raw token once, with its name and expiry", async () => { + const res = await POST(req({ name: "Watch bridge" }) as never); + const json = await res.json(); + expect(json.data.token).toMatch(/^hlk_[0-9a-f]{64}$/); + expect(json.data.name).toBe("Watch bridge"); + expect(json.data.expiresAt).toBeDefined(); + }); + + it("expires by default rather than living forever", async () => { + await POST(req({ name: "Export replay" }) as never); + const opts = vi.mocked(issueApiToken).mock.calls[0][0]; + expect(opts.expiresInDays).toBe(365); + }); + + it("honours an explicit lifetime", async () => { + await POST(req({ name: "Export replay", expiresInDays: 30 }) as never); + expect(vi.mocked(issueApiToken).mock.calls[0][0].expiresInDays).toBe(30); + }); + + it("audits the mint with the token id and the scope", async () => { + await POST(req({ name: "Export replay" }) as never); + expect(auditLog).toHaveBeenCalledWith( + "tokens.workouts.create", + expect.objectContaining({ + userId: USER.id, + details: expect.objectContaining({ + tokenId: "token-1", + scope: WORKOUTS_WRITE_SCOPE, + }), + }), + ); + }); + + it("counts only live tokens carrying this scope", async () => { + // The whole shape of the query, asserted rather than assumed. Counting + // every row would let the `["*"]` tokens a login mints consume the budget + // and refuse a mint for a reason the person cannot see; counting revoked + // or expired rows would mean revoking never frees a slot. + await POST(req({ name: "Export replay" }) as never); + + const where = vi.mocked(prisma.apiToken.count).mock.calls[0][0]?.where; + expect(where).toMatchObject({ + userId: USER.id, + revoked: false, + permissions: { has: WORKOUTS_WRITE_SCOPE }, + }); + expect(where?.OR).toEqual([ + { expiresAt: null }, + { expiresAt: { gt: expect.any(Date) } }, + ]); + }); +}); + +describe("when it refuses", () => { + it("403s while the operator has the API switched off", async () => { + vi.mocked(isApiGloballyEnabled).mockResolvedValue(false); + const res = await POST(req({ name: "Export replay" }) as never); + expect(res.status).toBe(403); + expect(issueApiToken).not.toHaveBeenCalled(); + }); + + it("429s past the mint rate limit, without minting", async () => { + vi.mocked(checkRateLimit).mockResolvedValue({ allowed: false } as never); + const res = await POST(req({ name: "Export replay" }) as never); + expect(res.status).toBe(429); + expect(issueApiToken).not.toHaveBeenCalled(); + }); + + it("422s on a missing name", async () => { + const res = await POST(req({}) as never); + expect(res.status).toBe(422); + expect(issueApiToken).not.toHaveBeenCalled(); + }); + + it("422s on a lifetime outside the permitted band", async () => { + const res = await POST( + req({ name: "Export replay", expiresInDays: 4000 }) as never, + ); + expect(res.status).toBe(422); + expect(issueApiToken).not.toHaveBeenCalled(); + }); + + it("409s at the live-token ceiling, without minting", async () => { + vi.mocked(prisma.apiToken.count).mockResolvedValue(10 as never); + const res = await POST(req({ name: "Export replay" }) as never); + + // 409, not 429: a conflict with the account's current state, whose remedy + // is revoking rather than waiting. A 429 would say the opposite. + expect(res.status).toBe(409); + expect((await res.json()).meta?.errorCode).toBe( + "tokens.workouts.ceiling_reached", + ); + expect(issueApiToken).not.toHaveBeenCalled(); + }); + + it("still mints on the last free slot", async () => { + // The off-by-one that would make the ceiling nine. Worth pinning, because + // `>=` versus `>` is invisible in review and only one of them is right. + vi.mocked(prisma.apiToken.count).mockResolvedValue(9 as never); + const res = await POST(req({ name: "Export replay" }) as never); + expect(res.status).toBe(201); + }); + + it("checks the ceiling only after the body validates", async () => { + // A malformed request should hear about the malformation, not the + // ceiling — and should not spend a query establishing it. + vi.mocked(prisma.apiToken.count).mockResolvedValue(10 as never); + const res = await POST(req({}) as never); + expect(res.status).toBe(422); + expect(prisma.apiToken.count).not.toHaveBeenCalled(); + }); + + it("ignores a scope the body tries to smuggle in", async () => { + // There is no `scope` field to validate, so an unknown key is simply not + // read — the permission array is a literal either way. Asserted because + // "the field does not exist" is the security property, and a schema change + // that added one would silently make this body meaningful. + await POST( + req({ + name: "Export replay", + scope: "read_write", + permissions: ["*"], + }) as never, + ); + expect(vi.mocked(issueApiToken).mock.calls[0][0].permissions).toEqual([ + WORKOUTS_WRITE_SCOPE, + ]); + }); +}); diff --git a/src/app/api/tokens/workouts/route.ts b/src/app/api/tokens/workouts/route.ts new file mode 100644 index 000000000..fca9acce0 --- /dev/null +++ b/src/app/api/tokens/workouts/route.ts @@ -0,0 +1,135 @@ +/** + * `POST /api/tokens/workouts` — mint a Bearer that can push workouts into the + * holder's own record and do nothing else (#1054). + * + * The door a workout bridge pushes through: a watch vendor's sync relayed by a + * small service, or a script replaying an exported history. It is the + * measurement-ingest mint (`../measurements/route.ts`) copied for a third + * scope, and every argument made there holds here — read that file for the + * reasoning behind each guard. In short: + * + * - `permissions` is a literal, so no request shape reaches it; + * - `workouts:write` is accepted by `POST /api/workouts/batch` alone, on the + * holder's own record; the rows it writes carry `EXTERNAL` provenance, and + * it cannot list or read a workout back, reach any other route, or mint + * another token; + * - minting takes a cookie session, because a short-lived native access token + * must not be able to leave behind a credential that lives a year; + * - ten mints a minute and ten live tokens bound a runaway loop. + * + * No listing and no revoke of its own: `GET /api/tokens` lists every token + * with its permissions and `DELETE /api/tokens/[id]` revokes one. + */ +import { NextRequest } from "next/server"; + +import { + apiHandler, + assertRecentCookieProof, + requireCookieAuth, +} from "@/lib/api-handler"; +import { + apiError, + apiSuccess, + getClientIp, + returnAllZodIssues, + safeJson, +} from "@/lib/api-response"; +import { annotate } from "@/lib/logging/context"; +import { auditLog } from "@/lib/auth/audit"; +import { prisma } from "@/lib/db"; +import { issueApiToken } from "@/lib/auth/issue-token"; +import { isApiGloballyEnabled } from "@/lib/app-settings"; +import { checkRateLimit } from "@/lib/rate-limit"; +import { WORKOUTS_WRITE_SCOPE } from "@/lib/workouts/scopes"; +import { createWorkoutTokenSchema } from "@/lib/validations/tokens"; + +/** + * Days a token lives when the caller names no lifetime. A year, like the + * measurement token: it is pasted into a bridge that runs unattended, where a + * quiet expiry surfaces as "my runs stopped showing up sometime in the spring". + */ +const DEFAULT_EXPIRY_DAYS = 365; + +/** Mints per user per minute. */ +const MINT_RATE_LIMIT_MAX = 10; +const MINT_RATE_LIMIT_WINDOW_MS = 60 * 1000; + +/** Live workout tokens an account may hold at once; catches a loop. */ +const MAX_LIVE_TOKENS = 10; + +export const POST = apiHandler(async (request: NextRequest) => { + const { user, session } = await requireCookieAuth(); + // And a fresh proof on top of the session: the token lives far longer than + // a stolen session would, so minting one needs the person, not just the + // browser. + await assertRecentCookieProof(user, session.id); + annotate({ action: { name: "tokens.workouts.create" } }); + + if (!(await isApiGloballyEnabled())) { + return apiError("API is globally disabled", 403); + } + + const rl = await checkRateLimit( + `tokens:workouts:mint:${user.id}`, + MINT_RATE_LIMIT_MAX, + MINT_RATE_LIMIT_WINDOW_MS, + ); + if (!rl.allowed) { + return apiError("Too many token mints, try again later", 429); + } + + const { data: body, error: jsonError } = await safeJson(request, { + maxBytes: 16 * 1024, + }); + if (jsonError) return jsonError; + + const parsed = createWorkoutTokenSchema.safeParse(body); + if (!parsed.success) { + return returnAllZodIssues(parsed.error, 422); + } + + // Counted live and per scope, after validation and before the create; the + // count-then-create race is bounded by the mint bucket above. See the + // measurement mint for the full argument. + const live = await prisma.apiToken.count({ + where: { + userId: user.id, + revoked: false, + permissions: { has: WORKOUTS_WRITE_SCOPE }, + OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }], + }, + }); + if (live >= MAX_LIVE_TOKENS) { + annotate({ + action: { name: "tokens.workouts.create" }, + meta: { outcome: "ceiling_reached", live_token_count: live }, + }); + return apiError( + `You already have ${MAX_LIVE_TOKENS} workout tokens. Revoke one before creating another.`, + 409, + { errorCode: "tokens.workouts.ceiling_reached" }, + ); + } + + const issued = await issueApiToken({ + userId: user.id, + name: parsed.data.name, + // A literal, never spread and never derived from the body. `issueApiToken` + // defaults to `["*"]` when this property is absent, which is why the unit + // suite asserts this array and not merely the 201. + permissions: [WORKOUTS_WRITE_SCOPE], + expiresInDays: parsed.data.expiresInDays ?? DEFAULT_EXPIRY_DAYS, + }); + + await auditLog("tokens.workouts.create", { + userId: user.id, + ipAddress: getClientIp(request), + details: { tokenId: issued.tokenId, scope: WORKOUTS_WRITE_SCOPE }, + }); + + // The raw token, once. It is stored as an HMAC and no path re-reveals it. + return apiSuccess( + { token: issued.token, name: issued.name, expiresAt: issued.expiresAt }, + 201, + ); +}); diff --git a/src/app/api/workouts/__tests__/batch-scope.test.ts b/src/app/api/workouts/__tests__/batch-scope.test.ts new file mode 100644 index 000000000..6fe7001f2 --- /dev/null +++ b/src/app/api/workouts/__tests__/batch-scope.test.ts @@ -0,0 +1,265 @@ +/** + * Who may call `POST /api/workouts/batch` (#1054). + * + * The route names `workouts:write`, so the set of credentials it admits is: + * a cookie session, a wildcard (`["*"]`) token, and a narrow token carrying + * exactly that scope. Every other narrow token — `measurements:write` + * included, however adjacent it looks — is refused 403 by the fail-closed + * default. + * + * The real `requireAuth` and the real `resolveBearerToken` run here; only the + * token row lookup is stubbed, so the admission decision under test is the + * production one rather than a re-implementation of it. + * + * The second half pins what a scoped caller writes: its rows are `EXTERNAL`, + * resolved from the credential, and a body naming any source is refused 422 + * rather than relabelled. A session and a wildcard token keep the source they + * send. + */ +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; +import { NextRequest } from "next/server"; + +vi.mock("@/lib/db", () => ({ + prisma: { + apiToken: { findUnique: vi.fn(), update: vi.fn() }, + user: { findUnique: vi.fn() }, + workout: { + findMany: vi.fn(), + createManyAndReturn: vi.fn(), + }, + workoutRoute: { createMany: vi.fn() }, + workoutSamples: { createManyAndReturn: vi.fn() }, + $transaction: vi.fn(async (fn: unknown) => { + if (typeof fn === "function") { + // eslint-disable-next-line @typescript-eslint/no-explicit-any + return (fn as any)(prisma as unknown as { workout: unknown }); + } + }), + }, +})); + +vi.mock("@/lib/auth/session", () => ({ getSession: vi.fn() })); +vi.mock("@/lib/auth/audit", () => ({ + auditLog: vi.fn().mockResolvedValue(undefined), +})); +vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() })); +vi.mock("@/lib/db-compat", () => ({ + ensureDbCompatibility: vi.fn().mockResolvedValue(undefined), +})); +vi.mock("@/lib/rate-limit", () => ({ checkRateLimit: vi.fn() })); +vi.mock("@/lib/jobs/pr-detection", () => ({ + enqueuePrDetection: vi.fn().mockResolvedValue(undefined), +})); +vi.mock("@/lib/arrivals/emit-shared", () => ({ + emitDataArrival: vi.fn().mockResolvedValue(undefined), +})); +vi.mock("next/headers", () => ({ + headers: vi.fn(async () => ({ get: () => null })), + cookies: vi.fn(async () => ({ + get: () => undefined, + set: () => {}, + delete: () => {}, + })), +})); + +import { POST } from "../batch/route"; +import { prisma } from "@/lib/db"; +import { getSession } from "@/lib/auth/session"; +import { headers } from "next/headers"; +import { checkRateLimit } from "@/lib/rate-limit"; +import { auditLog } from "@/lib/auth/audit"; +import { MEASUREMENTS_WRITE_SCOPE } from "@/lib/measurements/scopes"; +import { DOCUMENTS_WRITE_SCOPE } from "@/lib/documents/scopes"; +import { WORKOUTS_WRITE_SCOPE } from "@/lib/workouts/scopes"; + +const USER = { + id: "user-1", + username: "tester", + role: "USER" as const, + sourcePriorityJson: null, +}; +const TOKEN = "hlk_" + "c".repeat(64); + +function makeRequest(body: unknown): NextRequest { + return new NextRequest("http://localhost/api/workouts/batch", { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify(body), + }); +} + +function workout( + externalId: string, + overrides: Record = {}, +): Record { + return { + sportType: "running", + startedAt: "2026-09-20T06:30:00.000Z", + endedAt: "2026-09-20T07:15:00.000Z", + externalId, + ...overrides, + }; +} + +/** Present `TOKEN` as a Bearer whose row carries `permissions`. */ +function armToken(permissions: string[]) { + vi.mocked(getSession).mockResolvedValue(null as never); + vi.mocked(headers).mockResolvedValue({ + get: (name: string) => + name.toLowerCase() === "authorization" ? `Bearer ${TOKEN}` : null, + } as never); + vi.mocked(prisma.apiToken.findUnique).mockResolvedValue({ + id: "tok-1", + userId: USER.id, + permissions, + revoked: false, + expiresAt: new Date(Date.now() + 86_400_000), + } as never); +} + +function armSession() { + vi.mocked(getSession).mockResolvedValue({ + session: { id: "sess-1", expiresAt: new Date(Date.now() + 3_600_000) }, + user: USER, + } as never); +} + +/** The rows the route handed to `INSERT ... RETURNING`. */ +function insertedRows(): Array> { + return vi + .mocked(prisma.workout.createManyAndReturn) + .mock.calls.flatMap(([args]) => { + const data = (args as { data: unknown }).data; + return (Array.isArray(data) ? data : [data]) as Array< + Record + >; + }); +} + +beforeEach(() => { + vi.resetAllMocks(); + vi.stubEnv("API_TOKEN_HMAC_KEY", "k".repeat(64)); + vi.mocked(headers).mockResolvedValue({ get: () => null } as never); + vi.mocked(getSession).mockResolvedValue(null as never); + vi.mocked(checkRateLimit).mockResolvedValue({ + allowed: true, + limit: 60, + remaining: 60, + resetAt: Date.now() + 60_000, + }); + vi.mocked(prisma.apiToken.update).mockResolvedValue({} as never); + // The refusal path chains `.catch` on the audit write, so the reset mock + // has to hand back a promise again. + vi.mocked(auditLog).mockResolvedValue(undefined as never); + // One row serves both lookups: the resolver's user fetch and the route's + // source-priority read. + vi.mocked(prisma.user.findUnique).mockResolvedValue(USER as never); + vi.mocked(prisma.workout.findMany).mockResolvedValue([]); + vi.mocked(prisma.workout.createManyAndReturn).mockImplementation( + (async (args: { data: Array> }) => + args.data.map((row, index) => ({ + id: `w-${index}`, + source: row.source, + externalId: row.externalId, + }))) as never, + ); +}); + +afterEach(() => { + vi.unstubAllEnvs(); +}); + +describe("POST /api/workouts/batch — which credentials it admits", () => { + it("admits a narrow workouts:write token", async () => { + armToken([WORKOUTS_WRITE_SCOPE]); + const res = await POST(makeRequest({ workouts: [workout("s-1")] })); + expect(res.status).toBe(200); + const body = await res.json(); + expect(body.data.inserted).toBe(1); + }); + + it("still admits a cookie session", async () => { + armSession(); + const res = await POST( + makeRequest({ workouts: [workout("s-1", { source: "APPLE_HEALTH" })] }), + ); + expect(res.status).toBe(200); + }); + + it("still admits a wildcard token", async () => { + armToken(["*"]); + const res = await POST( + makeRequest({ workouts: [workout("s-1", { source: "APPLE_HEALTH" })] }), + ); + expect(res.status).toBe(200); + }); + + it.each([ + ["measurements:write", [MEASUREMENTS_WRITE_SCOPE]], + ["documents:write", [DOCUMENTS_WRITE_SCOPE]], + ["medication:ingest", ["medication:ingest", "medication:m-1:ingest"]], + ["health:read", ["health:read"]], + ])("refuses a %s token with 403 and writes nothing", async (_, perms) => { + armToken(perms); + const res = await POST(makeRequest({ workouts: [workout("s-1")] })); + expect(res.status).toBe(403); + expect(prisma.workout.createManyAndReturn).not.toHaveBeenCalled(); + }); +}); + +describe("POST /api/workouts/batch — what a scoped caller writes", () => { + it("attributes its rows to EXTERNAL", async () => { + armToken([WORKOUTS_WRITE_SCOPE]); + const res = await POST( + makeRequest({ workouts: [workout("s-1"), workout("s-2")] }), + ); + expect(res.status).toBe(200); + const rows = insertedRows(); + expect(rows).toHaveLength(2); + expect(rows.map((r) => r.source)).toEqual(["EXTERNAL", "EXTERNAL"]); + }); + + it("probes for duplicates in the EXTERNAL namespace", async () => { + armToken([WORKOUTS_WRITE_SCOPE]); + await POST(makeRequest({ workouts: [workout("s-1")] })); + const probe = vi + .mocked(prisma.workout.findMany) + .mock.calls.map(([args]) => args as { where?: { OR?: unknown } }) + .find((args) => args.where?.OR !== undefined); + expect(probe?.where?.OR).toEqual([ + { source: "EXTERNAL", externalId: "s-1" }, + ]); + }); + + it.each(["APPLE_HEALTH", "MANUAL"])( + "refuses a body naming %s with 422 and writes nothing", + async (source) => { + armToken([WORKOUTS_WRITE_SCOPE]); + const res = await POST( + makeRequest({ + workouts: [workout("s-1"), workout("s-2", { source })], + }), + ); + expect(res.status).toBe(422); + const body = await res.json(); + expect(body.meta?.errorCode).toBe("workout.batch.source_not_permitted"); + expect(prisma.workout.createManyAndReturn).not.toHaveBeenCalled(); + }, + ); + + it("leaves the source a wildcard caller sends alone", async () => { + armToken(["*"]); + await POST( + makeRequest({ workouts: [workout("s-1", { source: "APPLE_HEALTH" })] }), + ); + expect(insertedRows().map((r) => r.source)).toEqual(["APPLE_HEALTH"]); + }); + + it("leaves the source a session sends alone", async () => { + armSession(); + await POST( + makeRequest({ workouts: [workout("s-1", { source: "MANUAL" })] }), + ); + expect(insertedRows().map((r) => r.source)).toEqual(["MANUAL"]); + }); +}); diff --git a/src/app/api/workouts/batch/route.ts b/src/app/api/workouts/batch/route.ts index 5e1fe8b95..9d03b0390 100644 --- a/src/app/api/workouts/batch/route.ts +++ b/src/app/api/workouts/batch/route.ts @@ -1,7 +1,7 @@ /** * `POST /api/workouts/batch` — typed workout ingest with nested route. * - * Consumers (v1.5): + * Consumers: * 1. The native iOS app draining its HealthKit observer queue — * maps `HKWorkout` + `HKWorkoutRoute` samples into the request * shape locked by `createBatchWorkoutSchema` in @@ -15,12 +15,18 @@ * (MANUAL / APPLE_HEALTH), so this server path must write its * `WITHINGS`-sourced rows directly via `prisma.workout.upsert` * (as the WHOOP / Fitbit syncs already do), not through this route. + * 3. A third-party bridge holding a narrow `workouts:write` token + * (#1054) — a watch vendor's sync relayed by a small service. Its + * rows are attributed `EXTERNAL`, resolved from the credential; see + * the source guard in the handler. * * Cross-cutting concerns mirror `/api/measurements/batch` so the iOS * sync engine can re-use the same retry / cursor plumbing: - * - `requireAuth()` — cookie + Bearer (narrow-scope-token safe per - * v1.4.25 W10 fix-C: when the route declares no scope, any - * authenticated token passes). + * - `requireAuth` naming `WORKOUTS_WRITE_SCOPE` — a cookie session, a + * wildcard (`["*"]`) token, or a narrow `workouts:write` token. Every + * other narrow token is refused 403: under the fail-closed default a + * route admits exactly the scope it names, so a `measurements:write` + * credential does not reach this route. * - `withIdempotency` — `Idempotency-Key` header replays the cached * response on retry (24h window). * - `checkRateLimit("workouts:batch:${user.id}", 60, 60s)` — same @@ -59,7 +65,7 @@ import { NextRequest } from "next/server"; import { prisma } from "@/lib/db"; -import { apiHandler, requireAuth } from "@/lib/api-handler"; +import { apiHandler, isScopedCredential, requireAuth } from "@/lib/api-handler"; import { annotate } from "@/lib/logging/context"; import { auditLog } from "@/lib/auth/audit"; import { @@ -85,6 +91,8 @@ import { type UnstableExternalIdShape, } from "@/lib/validations/external-id"; import { dedupeWorkoutBatch } from "@/lib/workouts/canonical-rows"; +import { WORKOUTS_WRITE_SCOPE } from "@/lib/workouts/scopes"; +import { EXTERNAL_SOURCE } from "@/lib/measurements/external-source"; import { encryptRouteGeometry } from "@/lib/workouts/route-geometry-cipher"; import { Prisma, type MeasurementSource } from "@/generated/prisma/client"; @@ -169,7 +177,17 @@ async function emitWorkoutArrivals( export const POST = apiHandler(withIdempotency<[NextRequest]>(postBatch)); async function postBatch(request: NextRequest): Promise { - const { user } = await requireAuth(); + // Declares the workout-ingest scope, so a narrow `workouts:write` token + // reaches this route alongside cookie sessions and the wildcard tokens a + // native login mints. The only route that names it. `requireAuth` refuses + // any acting-account carrier for every credential shape, so the scoped token + // is confined to its owner's own record without an arm of its own here. + const auth = await requireAuth(WORKOUTS_WRITE_SCOPE); + const { user } = auth; + + // A scoped credential is a bridge, not the native client: the source of + // its rows is resolved from the credential below rather than from the body. + const scoped = isScopedCredential(auth); // v1.4.43 W9 — resolve the per-user source-priority blob once at // the start of the handler so the write-time canonical-row picker @@ -268,6 +286,27 @@ async function postBatch(request: NextRequest): Promise { }); } + // A scoped credential may attribute nothing: its rows are `EXTERNAL`, + // resolved from the credential. Refused loudly rather than relabelled, the + // measurement batch's rule and for its reasons. `APPLE_HEALTH` is half the + // `(userId, source, externalId)` dedup key the phone writes into and ranks + // first in the cross-source picker, so a bridge naming it would land in the + // phone's namespace and could shadow the phone's own copy of a session; + // `MANUAL` would make a bridged workout indistinguishable from one entered + // by hand. Checked on the raw body because the schema defaults an absent + // `source` to `MANUAL`, which would make "named" and "omitted" look alike. + if (scoped && namesAnySource(rawBody)) { + annotate({ + action: { name: "workout.batch.ingest" }, + meta: { outcome: "source_not_permitted" }, + }); + return apiError( + "This credential resolves the source itself; omit the field", + 422, + { errorCode: "workout.batch.source_not_permitted" }, + ); + } + const { workouts } = parsed.data; const refusedSampleIndices = new Set(parsed.refusedSampleIndices); @@ -359,7 +398,11 @@ async function postBatch(request: NextRequest): Promise { stepCount: w.stepCount ?? null, elevationM: w.elevationM ?? null, pauseDurationSec: w.pauseDurationSec ?? null, - source: w.source, + // `EXTERNAL` under a scoped credential, and nothing else: the guard + // above refused any body that named a source, so nothing asserted is + // discarded here. It also moves the dedup key into its own namespace, + // so a bridge's ids can never collide with the phone's. + source: scoped ? EXTERNAL_SOURCE : w.source, externalId: w.externalId ?? null, externalSourceVersion: w.externalSourceVersion ?? null, metadata: w.metadata @@ -373,7 +416,10 @@ async function postBatch(request: NextRequest): Promise { route, samples, dedupKey: w.externalId - ? { source: w.source, externalId: w.externalId } + ? { + source: scoped ? EXTERNAL_SOURCE : w.source, + externalId: w.externalId, + } : null, }, ]; @@ -719,3 +765,16 @@ async function postBatch(request: NextRequest): Promise { entries: results, }); } + +/** Whether any entry of a raw batch body names a `source` at all. */ +function namesAnySource(rawBody: unknown): boolean { + if (typeof rawBody !== "object" || rawBody === null) return false; + const workouts = (rawBody as { workouts?: unknown }).workouts; + if (!Array.isArray(workouts)) return false; + return workouts.some( + (w) => + typeof w === "object" && + w !== null && + (w as { source?: unknown }).source !== undefined, + ); +} diff --git a/src/components/admin/__tests__/backups-restore-preview.test.tsx b/src/components/admin/__tests__/backups-restore-preview.test.tsx new file mode 100644 index 000000000..892b55f2b --- /dev/null +++ b/src/components/admin/__tests__/backups-restore-preview.test.tsx @@ -0,0 +1,136 @@ +/** + * The restore dialog's contents box asks once and says honestly why it has + * nothing to show. + * + * A copy from an earlier version is read whole on the server, which took two + * minutes for a large record; the dialog stopped waiting, retried, and the + * server read the whole copy a second time (#1031). Pinned here: the preview + * query is never retried and carries its own timeout, and a timeout reads as + * "still being read", not as "could not be read". + * + * Mutation check: drop `retry: false` and the first case goes red; classify a + * timeout as unavailable and the second goes red. + */ +import { describe, expect, it, vi } from "vitest"; +import { renderToStaticMarkup } from "react-dom/server"; + +import { ApiError } from "@/lib/api/api-fetch"; +import { queryKeys } from "@/lib/query-keys"; + +const mocks = vi.hoisted(() => ({ + queries: [] as Array>, + apiGet: vi.fn(async () => ({ summary: {} })), +})); + +vi.mock("next/navigation", () => ({ + useRouter: () => ({ push: vi.fn(), replace: vi.fn() }), + usePathname: () => "/admin/backups", +})); + +vi.mock("sonner", () => ({ toast: { success: vi.fn(), error: vi.fn() } })); + +vi.mock("@/lib/api/api-fetch", async (importOriginal) => { + const actual = await importOriginal(); + return { ...actual, apiGet: mocks.apiGet }; +}); + +vi.mock("@tanstack/react-query", () => ({ + useQuery: (options: Record) => { + mocks.queries.push(options); + return { + data: { + rows: [ + { + id: "b1", + userId: "u1", + username: "self-hoster", + type: "WEEKLY_AUTO", + sizeBytes: 1024, + createdAt: "2026-09-01T03:00:00.000Z", + }, + ], + retentionDays: 30, + schedule: { + lastSuccessAt: "2026-09-01T03:00:00.000Z", + lastSuccessAgeDays: 2, + staleAfterDays: 10, + stale: false, + lastRun: null, + lastRunFailed: false, + }, + }, + isLoading: false, + isError: false, + }; + }, + useQueryClient: () => ({ invalidateQueries: vi.fn() }), + useMutation: () => ({ + mutate: vi.fn(), + mutateAsync: vi.fn(), + isPending: false, + isError: false, + error: null, + variables: undefined, + }), +})); + +vi.mock("@/hooks/use-auth", () => ({ + useAuth: () => ({ + user: { id: "u1", username: "testuser", role: "ADMIN" }, + isAuthenticated: true, + isLoading: false, + refetch: vi.fn(), + }), +})); + +import { I18nProvider } from "@/lib/i18n/context"; +import { BackupsSection, restorePreviewFailure } from "../backups-section"; + +describe("restore preview query", () => { + it("is never retried and waits a bounded time", async () => { + renderToStaticMarkup( + + + , + ); + const key = JSON.stringify(queryKeys.adminBackupSummary("b1")); + const preview = mocks.queries.find( + (options) => JSON.stringify(options.queryKey) === key, + ); + expect(preview).toBeDefined(); + expect(preview!.retry).toBe(false); + + await (preview!.queryFn as () => Promise)(); + const [path, init] = mocks.apiGet.mock.calls[0] as unknown as [ + string, + RequestInit, + ]; + expect(path).toBe("/api/admin/backups/b1/summary"); + expect(init.signal).toBeInstanceOf(AbortSignal); + }); +}); + +describe("restorePreviewFailure", () => { + it("reads a timeout as a copy still being read", () => { + const timeout = new DOMException("signal timed out", "TimeoutError"); + expect(restorePreviewFailure(timeout)).toBe("stillReading"); + }); + + it("names a missing key", () => { + expect( + restorePreviewFailure( + new ApiError("key", 422, { + errorCode: "backup.key.missing", + keyIds: ["v1"], + }), + ), + ).toBe("keyMissing"); + }); + + it("calls everything else unavailable", () => { + expect(restorePreviewFailure(new ApiError("boom", 500))).toBe( + "unavailable", + ); + expect(restorePreviewFailure(new TypeError("offline"))).toBe("unavailable"); + }); +}); diff --git a/src/components/admin/backups-section.tsx b/src/components/admin/backups-section.tsx index 53d708383..39f99924f 100644 --- a/src/components/admin/backups-section.tsx +++ b/src/components/admin/backups-section.tsx @@ -90,6 +90,39 @@ import { * Mirrors the wipe dialog's pattern but adds the typed gate because the * blast radius is bigger (re-creates rows, not just deletes). */ +/** + * How long the restore dialog waits for the contents of a copy. A copy's + * counts are kept with it and come back at once; this only runs out on a copy + * from an earlier version that the server is still reading whole, and stays + * under the minute a reverse proxy commonly allows a request. + */ +const PREVIEW_TIMEOUT_MS = 55_000; + +/** + * What the restore dialog says when the contents did not come back: the key + * the copy needs and this server lacks, a copy from an earlier version still + * being read when the dialog stopped waiting, or anything else. + */ +export function restorePreviewFailure( + error: unknown, +): "keyMissing" | "stillReading" | "unavailable" { + if ( + error instanceof ApiError && + error.meta?.errorCode === "backup.key.missing" + ) { + return "keyMissing"; + } + // `AbortSignal.timeout` rejects the fetch with a DOMException of this name. + if ( + typeof error === "object" && + error !== null && + (error as { name?: unknown }).name === "TimeoutError" + ) { + return "stillReading"; + } + return "unavailable"; +} + /** * v1.37.20 — the sections a restore preview names, in render order. Each * entry sums one or more `BackupSummary` counters under one human label; @@ -151,18 +184,25 @@ function RestoreRowDialog({ const [withInstanceSettings, setWithInstanceSettings] = useState(false); // v1.37.20 — restore preview: fetch what the file contains the moment the - // dialog opens, so the typed confirmation is an informed one. Derived from - // the same decrypt + schema path the restore itself runs. A failed preview - // never blocks the restore — it states its own absence instead. + // dialog opens, so the typed confirmation is an informed one. A failed + // preview never blocks the restore — it states its own absence instead. + // + // Never retried. The server answers from counts kept with the copy, at + // once; only a copy from an earlier version is read whole, and that read + // goes on (and is kept) after this request gives up. A retry would only + // start the same read a second time (#1031). const preview = useQuery({ queryKey: queryKeys.adminBackupSummary(row.id), queryFn: () => apiGet<{ summary: Record }>( `/api/admin/backups/${row.id}/summary`, + { signal: AbortSignal.timeout(PREVIEW_TIMEOUT_MS) }, ), enabled: open, staleTime: 60_000, + retry: false, }); + const previewFailure = restorePreviewFailure(preview.error); const numericSummary: Record = {}; if (preview.data?.summary) { for (const [key, value] of Object.entries(preview.data.summary)) { @@ -239,17 +279,21 @@ function RestoreRowDialog({

)} {preview.isError && - (preview.error instanceof ApiError && - preview.error.meta?.errorCode === "backup.key.missing" ? ( + (previewFailure === "keyMissing" && + preview.error instanceof ApiError ? ( // The one preview failure the restore would repeat: say which // key, so the operator can put it back before trying.

{t("admin.section.backups.previewKeyMissing", { - keys: Array.isArray(preview.error.meta.keyIds) + keys: Array.isArray(preview.error.meta?.keyIds) ? preview.error.meta.keyIds.map(String).join(", ") : "", })}

+ ) : previewFailure === "stillReading" ? ( +

+ {t("admin.section.backups.previewStillReading")} +

) : (

{t("admin.section.backups.previewUnavailable")} diff --git a/src/components/dashboard/__tests__/medication-intake-quick-add.test.tsx b/src/components/dashboard/__tests__/medication-intake-quick-add.test.tsx index c953ec8e1..343bedae8 100644 --- a/src/components/dashboard/__tests__/medication-intake-quick-add.test.tsx +++ b/src/components/dashboard/__tests__/medication-intake-quick-add.test.tsx @@ -71,6 +71,7 @@ function makeMed( name: `Med ${id}`, dose: "5 mg", active: true, + intakeActionable: true, schedules: [], lastTakenAt: null, todayEventCount: 0, @@ -316,6 +317,48 @@ describe(" — SSR contract", () => { } }); + // #1040 — the picker offers what the server calls actionable, nothing + // it re-derives. An ended course is still `active` (nobody paused it), + // which is exactly the case the old `active && trackIntake` filter let + // through. + it("does not offer an ended course, even though it is still active (#1040)", () => { + mockUseQuery.mockReturnValue({ + data: [ + makeMed("ended", { + name: "Alpha", + active: true, + intakeActionable: false, + }), + makeMed("current", { name: "Zulu" }), + ], + isLoading: false, + }); + const html = renderSSR(); + // Alphabetical fallback would land on "Alpha" if it were offered. + expect(html).toMatch( + /data-slot="select-value"[^>]*>[\s\S]*?Zulu[\s\S]*?<\/span>/, + ); + expect(html).not.toContain("Alpha"); + }); + + it("shows the empty state when no medication is actionable today (#1040)", () => { + mockUseQuery.mockReturnValue({ + data: [ + makeMed("ended", { name: "Alpha", intakeActionable: false }), + makeMed("upcoming", { name: "Beta", intakeActionable: false }), + ], + isLoading: false, + }); + const html = renderSSR(); + expect(html).toContain('data-testid="medication-intake-quick-add-empty"'); + expect(html).not.toContain( + 'data-testid="medication-intake-quick-add-form"', + ); + // The user has medications, so "no medications yet" would be untrue. + expect(html).toContain("Nothing to take today"); + expect(html).not.toContain("No medications yet"); + }); + it("does not leak raw i18n keys in either locale", () => { mockUseQuery.mockReturnValue({ data: [], isLoading: false }); const en = renderSSR(, "en"); diff --git a/src/components/dashboard/medication-intake-quick-add.tsx b/src/components/dashboard/medication-intake-quick-add.tsx index 52788fd3a..29ae37927 100644 --- a/src/components/dashboard/medication-intake-quick-add.tsx +++ b/src/components/dashboard/medication-intake-quick-add.tsx @@ -81,8 +81,13 @@ interface Schedule extends ScheduleWindowInput { export interface MedicationOption extends DefaultMedicationOption { dose: string; schedules: Schedule[]; - /** v1.39.1 (#1033) — false: kept as a record, not offered for a dose. */ - trackIntake?: boolean; + /** + * The server's answer to "does this medication offer a dose today" + * (active, intake tracked, course includes today; see + * `src/lib/medications/intake-actionable.ts`). The list read always + * carries it, so the picker renders from it and re-derives nothing. + */ + intakeActionable: boolean; } interface MedicationIntakeQuickAddProps { @@ -141,9 +146,10 @@ export function MedicationIntakeQuickAdd({ const medications = useMemo( () => Array.isArray(medicationsRaw) - ? // v1.39.1 (#1033) — a medication with intake tracking off is - // kept as a record; the dose capture does not offer it. - medicationsRaw.filter((m) => m.active && m.trackIntake !== false) + ? // #1040 — offer exactly what the cards, the table and "take + // all" offer: a paused, record-only, not-yet-started or ended + // course is not a dose to capture now. + medicationsRaw.filter((m) => m.intakeActionable === true) : [], [medicationsRaw], ); @@ -314,6 +320,10 @@ export function MedicationIntakeQuickAdd({ // anlegen` so the footer-slot promise holds across both // branches. if (!medicationsLoading && medications.length === 0) { + // Medications exist, none offers a dose today: say that, rather than + // "no medications yet", which would be untrue. + const noneActionable = + Array.isArray(medicationsRaw) && medicationsRaw.length > 0; const emptyFooter = (

{onCancel && ( @@ -328,7 +338,9 @@ export function MedicationIntakeQuickAdd({ )}
@@ -344,10 +356,16 @@ export function MedicationIntakeQuickAdd({