Merge remote-tracking branch 'origin/main' into feat/onboarding-wizard

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.38.16
+  version: 1.38.17
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
@@ -12021,7 +12021,9 @@ paths:
                 $ref: "#/components/schemas/ErrorEnvelope"
         "422":
           description: Body matched neither accepted shape, or `enabled` is true while the stored config has no server URL and
-            topic.
+            topic; or the server URL is on a private network the operator has not listed in
+            `NOTIFICATION_PRIVATE_ORIGINS` (`meta.errorCode` = `private_origin_not_approved`), or it is a link-local,
+            metadata or unspecified address that no grant can open (`private_origin_not_grantable`). Nothing was stored.
           content:
             application/json:
               schema:
@@ -12146,7 +12148,10 @@ paths:
         "413": *a19
         "415": *a20
         "422":
-          description: Body matched neither accepted shape, or `enabled` is true while no webhook URL is stored.
+          description: Body matched neither accepted shape, or `enabled` is true while no webhook URL is stored; or the URL is on
+            a private network the operator has not listed in `NOTIFICATION_PRIVATE_ORIGINS` (`meta.errorCode` =
+            `private_origin_not_approved`), or it is a link-local, metadata or unspecified address that no grant can
+            open (`private_origin_not_grantable`). Nothing was stored.
           content:
             application/json:
               schema:
@@ -12370,7 +12375,9 @@ paths:
       summary: Send a test message to the saved ntfy topic
       description: Publishes one message to the account's configured ntfy server and topic. Takes no body. Rate-limited 5 per
         5 minutes per user. Refuses with 400 when no ntfy channel is saved or when the saved config is missing a server
-        URL or topic; a publish failure is a 500.
+        URL or topic; a publish failure is a 500. A server on a private network is refused with 422 and `meta.errorCode`
+        = `private_origin_not_approved` unless the operator listed its exact origin in `NOTIFICATION_PRIVATE_ORIGINS`;
+        the test and the scheduled delivery take the same decision.
       responses:
         "200":
           description: The provider accepted the message. Not proof it was delivered.
@@ -12379,7 +12386,14 @@ paths:
               schema:
                 $ref: "#/components/schemas/NtfyTestEnvelope"
         "401": *a1
-        "422": *a4
+        "422":
+          description: The saved server is on a private network the operator has not approved (`meta.errorCode` =
+            `private_origin_not_approved`), or is a link-local, metadata or unspecified address that no grant can open
+            (`private_origin_not_grantable`). The resolved address is never echoed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
         "429": *a5
   /api/settings/telegram/test:
     post:
@@ -12412,7 +12426,9 @@ paths:
       description: Posts one payload to the account's configured webhook URL. Takes no body. Rate-limited 5 per 5 minutes per
         user. Refuses with 400 when no webhook channel is saved or the saved config has no URL; a delivery failure is a
         500. The URL was checked against the SSRF floor when it was saved, so a test cannot be used to reach an internal
-        host.
+        host. A URL on a private network is refused with 422 and `meta.errorCode` = `private_origin_not_approved` unless
+        the operator listed its exact origin in `NOTIFICATION_PRIVATE_ORIGINS`; the test and the scheduled delivery take
+        the same decision.
       responses:
         "200":
           description: The provider accepted the message. Not proof it was delivered.
@@ -12421,7 +12437,14 @@ paths:
               schema:
                 $ref: "#/components/schemas/WebhookTestEnvelope"
         "401": *a1
-        "422": *a4
+        "422":
+          description: The saved URL is on a private network the operator has not approved (`meta.errorCode` =
+            `private_origin_not_approved`), or is a link-local, metadata or unspecified address that no grant can open
+            (`private_origin_not_grantable`). The resolved address is never echoed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
         "429": *a5
   /api/settings/data:
     delete:
@@ -25769,9 +25792,10 @@ components:
       required:
         - enabled
       description: "ntfy channel config. `serverUrl` must pass the SSRF floor — a URL resolving into a private range is
-        refused at input time. An EMPTY OR OMITTED `authToken` preserves the stored one rather than clearing it: the GET
-        never returns the secret, so a client round-tripping the form would otherwise wipe it on every unrelated save.
-        Sending a non-empty value replaces it. There is no way to clear a stored auth token through this endpoint."
+        refused at input time unless the operator listed its exact origin in `NOTIFICATION_PRIVATE_ORIGINS`. An EMPTY OR
+        OMITTED `authToken` preserves the stored one rather than clearing it: the GET never returns the secret, so a
+        client round-tripping the form would otherwise wipe it on every unrelated save. Sending a non-empty value
+        replaces it. There is no way to clear a stored auth token through this endpoint."
     TelegramSettingsPutRequest:
       anyOf:
         - $ref: "#/components/schemas/NotificationChannelEnabledRequest"
@@ -25829,8 +25853,9 @@ components:
         - enabled
       description: "Generic-webhook channel config — one channel covering Gotify, Discord, Slack, a Matrix bridge, Home
         Assistant, or any relay accepting an inbound JSON POST. `url` must pass the SSRF floor at input time and is
-        re-checked at dispatch time. An EMPTY OR OMITTED `headerValue` preserves the stored one, for the same reason as
-        ntfy's `authToken`: the GET never returns it. There is no way to clear a stored header value through this
+        re-checked at dispatch time; a private origin passes both only when the operator listed it in
+        `NOTIFICATION_PRIVATE_ORIGINS`. An EMPTY OR OMITTED `headerValue` preserves the stored one, for the same reason
+        as ntfy's `authToken`: the GET never returns it. There is no way to clear a stored header value through this
         endpoint."
     DeleteAccountRequest:
       type: object
@@ -29998,8 +30023,8 @@ components:
                 dashboard_layout_conflict, empty_file, health_score_config_conflict, insights_layout_conflict,
                 invalid_base_updated_at, json_carries_no_intake_time, json_not_an_array, medication_layout_conflict,
                 missing_required_columns, modules_conflict, mood_tag_layout_conflict, not_configured,
-                notification_prefs_conflict, oidc_only, private_origin_not_approved, rate_limited_self, too_many_rows,
-                unreadable_json, upstream_invalid_json, vapid_not_configured"
+                notification_prefs_conflict, oidc_only, private_origin_not_approved, private_origin_not_grantable,
+                rate_limited_self, too_many_rows, unreadable_json, upstream_invalid_json, vapid_not_configured"
               type: string
           additionalProperties: {}
       required: