Merge remote-tracking branch 'origin/main' into feat/onboarding-wizard

# Conflicts:
#	docs/api/openapi.yaml
#	src/lib/openapi/error-codes.ts

src/app/api/cycle/calendar/route.ts

@@ -121,6 +121,12 @@ export const GET = apiHandler(async (request: NextRequest) => {
     // Apple Watch wrist/skin temperature feeds the temperature-trend
     // ovulation layer. Read the WRIST_TEMPERATURE measurements as nightly
     // values; the engine derives the trailing-mean deviation itself.
+    //
+    // This is a measurements read on a route declared under `cycle`, and it
+    // needs no section predicate for one reason: no value from it reaches the
+    // response. It goes into `predictCycle` and what comes out the other side
+    // is a shifted date. The crosstab next door reads the same channel and IS
+    // fenced, because there the values are the answer.
     prisma.measurement.findMany({
       where: {
         userId: user.id,

src/app/api/cycle/insights/route.ts

@@ -16,6 +16,7 @@
  */
 import { prisma } from "@/lib/db";
 import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 import { annotate } from "@/lib/logging/context";
 import { apiSuccess, apiError } from "@/lib/api-response";
 import { requireCycleEnabled } from "@/lib/cycle/gate";
@@ -50,7 +51,7 @@ const WINDOW_DAYS = 365;
 export const dynamic = "force-dynamic";
 
 export const GET = apiHandler(async () => {
-  const { user } = await requireRecordAuth("read", "cycle");
+  const { user, grantId } = await requireRecordAuth("read", "cycle");
 
   const gate = await requireCycleEnabled(user.id, user.gender);
   if (!gate.enabled) return gate.response;
@@ -68,6 +69,19 @@ export const GET = apiHandler(async () => {
   const today = moodDateKey(new Date(), tz);
   const from = addDays(today, -WINDOW_DAYS);
 
+  // The crosstab is a cycle surface that reads two other sections. The phase
+  // labels are cycle data; the outcome columns are not. `lutealAvg`,
+  // `follicularAvg` and `delta` ship resting heart rate, HRV, sleep duration,
+  // steps, weight, temperature, glucose and the mood score in display units,
+  // and a grant scoped to the cycle alone was never consent for any of them.
+  // So the two foreign channels are fenced at the query, not at the response:
+  // a section the caller is outside of is never read, so nothing downstream
+  // can leak it back — the rows simply do not exist, exactly as they do not
+  // for a record with no measurements.
+  const visible = await actingDomainVisibility(prisma, grantId);
+  const seesMeasurements = visible("measurements");
+  const seesMind = visible("mind");
+
   const [
     cycles,
     dayLogRows,
@@ -116,25 +130,28 @@ export const GET = apiHandler(async () => {
       select: { measuredAt: true, value: true },
     }),
     // The outcome metrics the phase contrast compares — soft-delete-scoped,
-    // canonical-source deduped per day inside `metricDayMap`.
-    prisma.measurement.findMany({
-      where: {
-        userId: user.id,
-        deletedAt: null,
-        type: { in: PHASE_CROSSTAB_METRIC_TYPES },
-        measuredAt: {
-          gte: new Date(Date.parse(`${from}T00:00:00Z`)),
-        },
-      },
-      orderBy: { measuredAt: "asc" },
-      select: {
-        type: true,
-        value: true,
-        measuredAt: true,
-        source: true,
-        deviceType: true,
-      },
-    }),
+    // canonical-source deduped per day inside `metricDayMap`. Skipped whole
+    // for a caller outside `measurements`.
+    seesMeasurements
+      ? prisma.measurement.findMany({
+          where: {
+            userId: user.id,
+            deletedAt: null,
+            type: { in: PHASE_CROSSTAB_METRIC_TYPES },
+            measuredAt: {
+              gte: new Date(Date.parse(`${from}T00:00:00Z`)),
+            },
+          },
+          orderBy: { measuredAt: "asc" },
+          select: {
+            type: true,
+            value: true,
+            measuredAt: true,
+            source: true,
+            deviceType: true,
+          },
+        })
+      : [],
     prisma.user.findUnique({
       where: { id: user.id },
       select: { sourcePriorityJson: true },
@@ -142,15 +159,18 @@ export const GET = apiHandler(async () => {
     // MOOD outcome (QA HIGH): mood lives in MoodEntry (1–5 score), not a
     // Measurement row, so read it here and inject it into the crosstab as a
     // synthetic MOOD_CHANNEL_KEY measurement (same FDR / day-floor guards).
-    prisma.moodEntry.findMany({
-      where: {
-        userId: user.id,
-        deletedAt: null,
-        moodLoggedAt: { gte: new Date(Date.parse(`${from}T00:00:00Z`)) },
-      },
-      orderBy: { moodLoggedAt: "asc" },
-      select: { score: true, moodLoggedAt: true },
-    }),
+    // Skipped whole for a caller outside `mind`.
+    seesMind
+      ? prisma.moodEntry.findMany({
+          where: {
+            userId: user.id,
+            deletedAt: null,
+            moodLoggedAt: { gte: new Date(Date.parse(`${from}T00:00:00Z`)) },
+          },
+          orderBy: { moodLoggedAt: "asc" },
+          select: { score: true, moodLoggedAt: true },
+        })
+      : [],
   ]);
 
   // The latest open cycle runs to the predicted next-period start so the
@@ -239,6 +259,8 @@ export const GET = apiHandler(async () => {
       lagged_discovered: lagged.discovered.length,
       lagged_pairs_tested: lagged.pairsTested,
       symptom_patterns: symptomPatterns.length,
+      measurements_visible: seesMeasurements,
+      mind_visible: seesMind,
     },
   });
 

src/app/api/encounters/[id]/links/route.ts

@@ -27,10 +27,8 @@ import {
 } from "@/lib/api-response";
 import { encounterLinkSchema } from "@/lib/validations/encounters";
 import { linkTargets, unlinkTargets } from "@/lib/links";
-import {
-  actingDomainVisibility,
-  loadEncounterLinks,
-} from "@/lib/encounters/service";
+import { loadEncounterLinks } from "@/lib/encounters/service";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 type RouteParams = { params: Promise<{ id: string }> };
 

src/app/api/encounters/[id]/restore/route.ts

@@ -22,12 +22,12 @@ import { encounterKindLabel } from "@/lib/encounters/kind-label";
 import { toEncounterDTO } from "@/lib/encounters/dto";
 import {
   ENCOUNTER_INCLUDE,
-  actingDomainVisibility,
   loadEncounterLinks,
   resolveOwnerNotificationContext,
   shouldHaveReminder,
 } from "@/lib/encounters/service";
 import { reanchorAppointmentReminder } from "@/lib/encounters/appointment-reminder";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 type RouteParams = { params: Promise<{ id: string }> };
 

src/app/api/encounters/[id]/route.ts

@@ -35,7 +35,6 @@ import { encounterKindLabel } from "@/lib/encounters/kind-label";
 import { toEncounterDTO } from "@/lib/encounters/dto";
 import {
   ENCOUNTER_INCLUDE,
-  actingDomainVisibility,
   applyEncounterLinks,
   closeCheckupForVisit,
   findOwnAppointmentReminderId,
@@ -54,6 +53,7 @@ import {
   type RestoreSkipLog,
 } from "@/lib/export/restore-skips";
 import type { Prisma } from "@/generated/prisma/client";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 type RouteParams = { params: Promise<{ id: string }> };
 

src/app/api/encounters/route.ts

@@ -36,7 +36,6 @@ import { encounterKindLabel } from "@/lib/encounters/kind-label";
 import { toEncounterDTO, type EncounterListDTO } from "@/lib/encounters/dto";
 import {
   ENCOUNTER_INCLUDE,
-  actingDomainVisibility,
   applyEncounterLinks,
   loadEncounterLinksForMany,
   closeCheckupForVisit,
@@ -51,6 +50,7 @@ import {
   summarizeRestoreSkips,
   type RestoreSkipLog,
 } from "@/lib/export/restore-skips";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 export const GET = apiHandler(async (request: NextRequest) => {
   const { user, grantId } = await requireRecordAuth("read", "profile");

src/app/api/mental-health/assessments/route.ts

@@ -159,6 +159,17 @@ async function postAssessment(request: NextRequest): Promise<Response> {
   // into the record: the ordinary way this instrument is used when the person
   // it is about cannot run their own record. The row records what the person
   // in the room reported; the audit row says who typed it.
+  //
+  // It writes ONE row outside its declared section, and the crossing is
+  // deliberate rather than an oversight: the `*_SCORE` Measurement below is a
+  // projection of this administration, minted `COMPUTED`, keyed on
+  // `assessment:<id>`, and it exists only so the trend reads through the chart
+  // and rollup tier without ever touching the encrypted item content. Fencing
+  // it on `measurements` the way the booster mint is fenced would file a
+  // screener whose own total is missing from the record — an inconsistency
+  // inside the section the grant DOES open, to avoid a derived point in one it
+  // does not. The consent copy for this section says so, which is where a
+  // widening belongs.
   const { user, actor } = await requireRecordAuth("manage", "mind");
 
   // Opt-in module (default OFF) — same gate as GET.

src/app/api/vaccinations/[id]/booster/route.ts

@@ -13,11 +13,21 @@
  * even when a delegate is transcribing. The antigen is read from the dose's
  * catalogue entry server-side, never from the body — a client cannot key a
  * reminder onto an antigen the dose does not contain.
+ *
+ * The row it mints is a `MeasurementReminder`, and that model belongs to the
+ * `measurements` section: every direct route over it declares that domain, and
+ * creating one needs MANAGE there. So the act crosses a seam, and a grant
+ * scoped to the health background alone was never consent for the other side
+ * of it — it would produce a row on the owner's checkup list that the delegate
+ * can neither read nor change through the section that owns it. The seam is
+ * fenced the way the visits service fences a checkup closure: the mint runs
+ * only while the caller is inside `measurements`.
  */
 import { NextRequest } from "next/server";
 
 import { prisma } from "@/lib/db";
 import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import {
@@ -36,9 +46,24 @@ type RouteParams = { params: Promise<{ id: string }> };
 
 export const POST = apiHandler(
   async (request: NextRequest, { params }: RouteParams) => {
-    const { user } = await requireRecordAuth("write", "profile");
+    const { user, grantId } = await requireRecordAuth("write", "profile");
     const { id } = await params;
 
+    // Refused rather than skipped, and that is the difference from the visit's
+    // checkup closure: there the closure is one effect of a larger save and
+    // saying "not done" keeps the save honest, while here the reminder IS the
+    // request. Reporting success over a row that was never written would tell
+    // the person their booster is planned when nothing rings.
+    const visible = await actingDomainVisibility(prisma, grantId);
+    if (!visible("measurements")) {
+      annotate({ meta: { sharing_refusal: "booster_out_of_scope" } });
+      return apiError(
+        "Planning a booster needs access to this record's measurements",
+        403,
+        { errorCode: "vaccination.booster-out-of-scope" },
+      );
+    }
+
     const { data: rawBody, error: jsonError } = await safeJson(request, {
       maxBytes: 8 * 1024,
     });

src/app/api/vaccinations/[id]/links/route.ts

@@ -26,10 +26,8 @@ import {
 } from "@/lib/api-response";
 import { vaccinationLinkSchema } from "@/lib/validations/vaccinations";
 import { linkTargets, unlinkTargets } from "@/lib/links";
-import {
-  actingDomainVisibility,
-  loadVaccinationDocuments,
-} from "@/lib/vaccinations/service";
+import { loadVaccinationDocuments } from "@/lib/vaccinations/service";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 type RouteParams = { params: Promise<{ id: string }> };
 

src/app/api/vaccinations/[id]/restore/route.ts

@@ -20,10 +20,10 @@ import { apiSuccess, apiError, getClientIp } from "@/lib/api-response";
 import { toVaccinationDTO } from "@/lib/vaccinations/dto";
 import {
   VACCINATION_INCLUDE,
-  actingDomainVisibility,
   loadVaccinationDocuments,
   resolveSeriesFor,
 } from "@/lib/vaccinations/service";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 type RouteParams = { params: Promise<{ id: string }> };
 

src/app/api/vaccinations/[id]/route.ts

@@ -32,7 +32,6 @@ import { vaccinationUpdateSchema } from "@/lib/validations/vaccinations";
 import { toVaccinationDTO } from "@/lib/vaccinations/dto";
 import {
   VACCINATION_INCLUDE,
-  actingDomainVisibility,
   applyVaccinationLinks,
   loadVaccinationDocuments,
   resolveOwnedEncounter,
@@ -40,6 +39,7 @@ import {
   resolveSeriesFor,
 } from "@/lib/vaccinations/service";
 import type { Prisma } from "@/generated/prisma/client";
+import { actingDomainVisibility } from "@/lib/sharing/acting-domains";
 
 type RouteParams = { params: Promise<{ id: string }> };