From 629e5396c6f837948f39d8aa135be4dd8d3a459b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 16 Jun 2026 02:07:34 +0200 Subject: [PATCH] test(modules): move gated workout read routes off the exempt inventory The workout list + detail reads now carry requireModuleEnabled, so the route-gate inventory's exempt allowlist must stop claiming them as ungated data-layer surfaces. Only the iOS batch ingest stays exempt. --- .../__tests__/module-route-gate-inventory.test.ts | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/app/api/__tests__/module-route-gate-inventory.test.ts b/src/app/api/__tests__/module-route-gate-inventory.test.ts index 4a4bbf87f..d312df72f 100644 --- a/src/app/api/__tests__/module-route-gate-inventory.test.ts +++ b/src/app/api/__tests__/module-route-gate-inventory.test.ts @@ -107,11 +107,13 @@ const EXEMPT_ROUTES: ReadonlyArray = [ "src/app/api/mood/tags/groups/[key]/route.ts", "src/app/api/mood/tags/[key]/hidden/route.ts", // ── DATA LAYER (workouts / labs) ────────────────────────────────── - // Raw Workout + LabResult CRUD + the iOS batch ingest. Same data-layer - // reasoning: the workouts / labs modules gate the surfaces (Insights - // pill, dashboard tile, doctor-report section), not the row store. - "src/app/api/workouts/route.ts", - "src/app/api/workouts/[id]/route.ts", + // The workout READ surfaces (`GET /api/workouts`, `GET /api/workouts/{id}`) + // are now module-gated — they back the hidden Insights workouts surface, so + // a disabled account must not read them even over a Bearer token. Only the + // iOS batch INGEST stays exempt: synced workouts must keep landing in the + // row store while the surface is hidden, so re-enabling reveals a complete + // history rather than a gap. LabResult CRUD follows the same data-layer + // reasoning (the labs module gates the surfaces, not the row store). "src/app/api/workouts/batch/route.ts", "src/app/api/labs/route.ts", "src/app/api/labs/[id]/route.ts",