audit(v1.3.3): SpO2 + body-composition + 14 CRITICAL/HIGH security/correctness fixes (#121)

* fix(measurements): close issue #109 + sync body composition across UI/PDF/thresholds User-visible: TOTAL_BODY_WATER, BONE_MASS, and BLOOD_GLUCOSE now appear in the measurements filter, badge, mobile icon, and edit dialog (issue #109). Server-rendered doctor report now includes body composition rows (audit C-9). Body water + bone mass have proper effective-range thresholds so severity logic doesn't silently return `nominal` (audit C-15). Structural: extracted the per-type display maps from measurement-list.tsx into measurement-list-meta.ts as a deliberate first step toward the single-source manifest planned for phase P5. Coverage tests now fail-fast if a future enum addition skips any of: list label/icon/color, doctor-PDF label/unit/vital-types, chart label, threshold metric order/label/bounds. Audit-2026-05-07 / phase P0: - closes #109 (filter UI gap, root cause for the German raw-enum display) - closes audit C-9 (server PDF used a stale type map) - closes audit C-15 (no warn/critical bands for body composition) Tests: 282 → 296 (14 new). Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: align OpenAPI spec + migration comment with body-composition reality - OpenAPI MeasurementType enum: add TOTAL_BODY_WATER + BONE_MASS (was at v1.3.0 baseline; spec drifted past the v1.3 server release) - Bump openapi version 1.3.0 → 1.3.2 to match package.json - Migration 0022 comment: TOTAL_BODY_WATER stores kg (water content), not percent of body weight. Validators (VALUE_RANGES) and the Withings client (type 77 → kg) treat it as kg already; the comment was the lone outlier and would mislead the next reviewer. Audit-2026-05-07 / phase P1a — closes audit M-B1 (partial; OpenAPI enum) and M-B2 (migration unit comment). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): close 3 audit CRITICALs (Withings header / idempotency Bearer / GlitchTip URL strip) C-3 (Withings webhook secret in URL): Now reads X-Withings-Webhook-Secret header in preference; URL ?secret=… fallback retained for legacy Withings configurations and emits a Wide Event warning so operators can spot still-using-the-old-flow integrators. The query-string secret was leaking into Coolify access logs and any GlitchTip event whose request.url got captured. C-4 (idempotency dead for Bearer-token clients): The default userIdResolver only consulted getSession(). Bearer-authed clients (the iOS / n8n / headless-API fleet that PR #117 was built for) fell through, so every retry created duplicate measurements. The default now tries cookie session first, then Bearer token via hashToken+apiToken.findUnique with revoked/expiry checks. All three existing call sites (measurements, mood-entries, medications/intake) get the fix automatically. H-B7 (request.url with secrets shipped to GlitchTip): reportToGlitchtip now strips the query string before forwarding the URL, so Withings legacy ?secret=… and any OAuth ?code=… that errors during the callback don't end up in someone else's incident UI. Audit-2026-05-07 / phase P2. Tests: 296 → 301 (5 new in idempotency.test for the Bearer fallback + revoked/expired/null cases). Deferred to a follow-up (needs DB migration / lock primitive): C-2 moodLog webhook → AES-GCM at rest + HMAC-over-body C-5 idempotency TOCTOU advisory_lock or in-flight sentinel row Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(measurements): add OXYGEN_SATURATION (SpO2) as first-class measurement type — v1.3.3 Closes the OxygenSaturation feature request from #109. - Migration 0024 extends MeasurementType enum (additive, IF NOT EXISTS) - Zod validators: plausibility 50–100% (below 50 is incompatible with sustained life; above 100 is physically impossible) - effective-range thresholds: green 95–100, orange 92–94, red <92. Sources: BTS Guideline 2017 (target 94–98%), ATS clinical practice (≥95% at rest is healthy), AHA/clinical literature (<92% = call provider, <88% = ER). Lower-only concern — upper orange wing collapses to greenMax since saturation cannot exceed 100%. - Personalisation: existing thresholds-override UI lets COPD / chronic-respiratory users with a doctor-set 88–92 baseline tune the bands. METRIC_ORDER + METRIC_LABEL_KEYS extended in thresholds-section.tsx; the exhaustive `Record<ThresholdMetric>` forces TS to catch any missed surface. - Withings ScanWatch type 54 mapping (best-effort — only fires for pulse-ox-capable devices). - Wired through measurement-form, measurement-list-meta (icon: Wind), health-chart, both doctor-report-pdf renderers (core + browser-side near-duplicate), OpenAPI spec (version 1.3.0 → 1.3.3), and i18n in 4 sections × 2 locales. - iOS DTO already declared `OXYGEN_SATURATION` — server enum addition closes the long-standing drift flagged in audit V2. - 4 new tests: numeric green band, upper-wing collapse, user-override (COPD baseline), METRIC_BOUNDS shape. Tests: 301 → 305. Typecheck: clean. Audit-2026-05-07 / v1.3.3 / closes #109 SpO2 feature request. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(analytics): truthfulness pass on medical citations + clamp override orangeMax Doctor-agent + hallucination-hunter audit V3 found six medical citations in effective-range.ts that the code did not actually implement. Plus a latent bug in the user-override path that produced physically-impossible orangeMax values (>100% saturation, <0% body-fat). Citation rewrites (no numeric changes): - ACTIVITY_STEPS: "WHO ≥8000 steps/day" → Saint-Maurice JAMA 2020. WHO publishes activity in min/week, not steps. Step-count was a misattribution that also leaked into AI prompts. - TOTAL_BODY_WATER: "ESPEN Body Composition Guidance 2017" → Watson formula / ICRP Reference Man. ESPEN 2017 is BIA practice guidance, it does not publish kg cut-offs. - BONE_MASS: "DEXA-equivalent bone mineral content" → "Bioimpedance- estimated; not DEXA-comparable". Withings BIA values typically run 5–7% below DEXA — calling them DEXA-equivalent in a doctor-report PDF was a real legal-exposure misattribution. - OXYGEN_SATURATION: "BTS Guideline 2017 (target 94–98%) + ATS clinical practice (≥95% at rest is healthy)" → "consumer pulse- oximeter consensus (≥95% normal at rest); slightly tighter than BTS 2017 (94–98%); NICE NG115 ≤92% escalation, BMJ panel / FDA pulse-oximeter labelling ≤88% ER threshold". Code uses 95-100/92-100 band — that's an ATS/consumer-consensus number, not BTS's literal 94-98 target. Soften the citation to match the code, not vice versa. Bug fix (1 latent, 1 real-today): - effective-range override path now clamps orangeMin/orangeMax to METRIC_BOUNDS.{min,max}. Without the clamp, a COPD user setting SpO2 override to {95,100} emitted orangeMax = 100.75 (impossible saturation), and a BODY_FAT override of {2,80} emitted orangeMin = -9.7 (negative percent). Default-range case 210 already hard-coded orangeMax: 100 for the same reason — the override path was the only branch missing the invariant. Tests: 305 → 306 (1 new: clamps override orangeMax to physiological 100%). Typecheck: clean. Audit-2026-05-07-V3 / closes Doctor + Senior-Dev medical-citation findings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): Bearer-scope wildcard handling + GDPR Art.17 account-delete erasure Two CRITICAL fixes from audit V3. NEW-V3-1: Bearer-scope bypass. apiToken.permissions ["*"] is meant to be the wildcard "session-equivalent" scope (the iOS app receives this on login). The previous check permissions.includes(requiredPermission) treated "*" as a literal string — never matched. Today many sensitive routes call requireAuth() *without* a requiredPermission, so a leaked iOS token can act as a full-scope token (account delete, settings wipe). Once those routes adopt requireAuth("scope:name"), this wildcard handling keeps the iOS app working while narrower-scoped tokens (e.g. user-issued ["medication:ingest"]) get correctly 403'd. Same wildcard handling added to the standalone permission checks in src/app/api/ingest/medication/route.ts:65, 119. NEW-V3-2: GDPR Art. 17 account-delete erasure completeness. Feedback + AuditLog rows had `onDelete: SetNull` in the schema, which preserved PII (free-text symptom descriptions, IP addresses, login-city geolocation) after the user was deleted. We now explicitly prisma.feedback.deleteMany + prisma.auditLog.deleteMany before the cascade-delete, making account deletion genuinely complete erasure. Tests 306/306 still pass; typecheck clean. Audit V3. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(pdf): real text-content assertions for body composition + SpO2 rows Replaces bytes-only "renders body composition rows" theatre test with pdf-parse-driven text extraction that asserts the actual rendered labels + values for TOTAL_BODY_WATER, BONE_MASS, OXYGEN_SATURATION (DE + EN). Closes V3 audit finding STILL-V2-NEW-3: the previous test only verified "%PDF-" header + byte-count, so a regression that drops a row would still pass. Now a missing label fails the test. - adds dev dep: pdf-parse@^2.4.5 - 308/308 tests pass (was 306, +2 SpO2 + EN-locale coverage) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(measurements): close enum drift cousins — derive 5 type-arrays from canonical enum + extend 2 contract enums V3 audit finding "enum drift cousins": 7 hardcoded module-level type arrays silently dropped SpO2/TBW/BoneMass/BloodGlucose from their respective domains. Adding a new measurement type required hunting these down. Now all aggregation paths derive from `measurementTypeEnum.options`: - /api/insights/comprehensive (AI insights) - /api/dashboard/summary (iOS dashboard adapter) - /api/analytics (analytics aggregator) - /lib/insights/general-status (AI general-status fetch) - /api/import (Zod schema — round-trip now covers all 11 types) External-contract enums extended additively (no breakage for old clients): - /api/measurements/series kindEnum: + oxygen, totalBodyWater, boneMass - /api/dashboard/widgets widgetIdEnum: + oxygenSaturation - DashboardWidgetId + DEFAULT_DASHBOARD_LAYOUT: + oxygenSaturation row - formatMeasurementsForExport: glucoseContext now round-trips Coverage test (`measurement-type-enum-coverage.test.ts`) asserts the canonical enum stays the source of truth and documents PDF exclusions (BLOOD_GLUCOSE renders via context section, SLEEP/STEPS lifestyle-only). 313/313 tests pass (was 308, +5 new). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): close 6 V3-audit HIGH findings (CSP, web-push SSRF, IP geo, AI provider leak, import rate-limit) - CSP: chatgpt.com + api.openai.com only on /settings/ai/** routes (was blanket connect-src on every page including /auth/login → DOM-XSS exfil channel) - web-push: webPushSubscriptionSchema.endpoint requires HTTPS + isPublicUrl refinement; was z.url() only → blind SSRF probe via Push subscription - isPublicUrl: also fixes a regression where DNS labels starting with "fc"/"fd" (fcm.googleapis.com etc.) were falsely classified as IPv6 unique-local. Check is now gated on a colon being present in the host. - /api/ai/test: stop returning provider err.message + bodyExcerpt to the client (leaked provider URLs / partial keys / internal headers). Now returns categorised generic message; full details land in the wide-event via annotate() for the operator. - /lib/geo (auditLog IP geo lookup): switch default provider to ipwho.is over HTTPS, accept ipwho.is + ip-api pro response shapes, add IP_GEO_LOOKUP_DISABLED env, refuse non-HTTPS configured URLs. Previously leaked IP+timestamp over plaintext HTTP every auth event (GDPR Art. 32 + Art. 44). - /api/import: add 5/hour rate-limit (was unlimited; bulk-injection vector) Tests: 325/325 pass (was 313, +12 new — webPushSubscriptionSchema SSRF guards, fc/fd-prefix domain regression, geo HTTPS-only, geo provider shapes, geo opt-out env). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security,gdpr): trusted-proxy IP, audit-log retention, idempotency cachable filter, Bearer mock tightening V3 audit follow-on bundle covering 4 HIGH findings. (I) getClientIp — TRUST_PROXY_HOPS env (default 1) replaces blind XFF trust. Reads chain right-to-left so client-supplied leftmost entries cannot rotate the per-IP rate-limit bucket. Default 1 matches typical single-proxy self-host (Coolify/Caddy/Cloudflare-Tunnel); 0 forces x-real-ip / null. New 7-test suite covers the rotation attack + malformed entries + zero-hop fallback. (F) Audit-log retention job — daily 03:15 cleanup of audit_logs older than AUDIT_LOG_RETENTION_DAYS (default 365). Closes GDPR Art. 5(1)(e) "storage limitation" gap; previously IPs + city + login events accumulated forever. 6-test suite covers default + override + misconfig guard (rejects <7 days). (G) isCachableStatus — extracted the inline 4xx/5xx filter into a named, exported, tested function. 7 cases cover the full do-not-cache contract (401 / 403 / 408 / 429 / any 5xx) and confirm 2xx + 4xx validation are still cached. (H) Bearer-mock tightening — apiToken.findUnique mocks in require-auth-bearer.test + idempotency.test now assert the where.tokenHash shape uses the hashed value (not the raw bearer). A regression that switched back to raw-token comparison would have been silent without this assertion. Tests: 345/345 pass (was 332, +13 new). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): encrypt moodLog webhook secret at rest with AES-256-GCM (V3 audit STILL-V2-C-2) The mood_log_webhook_secret column previously stored a plaintext secret that the webhook handler compared timing-safe against every enabled user. A DB dump or backup snapshot leaked active webhook credentials. New contract — no schema migration required: - Writes go through encryptMoodLogSecret() (AES-256-GCM via existing crypto helper, ENCRYPTION_KEY). - Reads go through readMoodLogSecret() which transparently decrypts envelopes and tolerates legacy plaintext rows during the transition (graceful upgrade path — no breaking change for self-hosted users). - Webhook lookup decrypts each candidate before timing-safe compare. - Status endpoint decrypts for the user's settings page. One-shot startup migration in reminder-worker rotates any leftover plaintext rows on next worker boot. Idempotent; encrypted rows are skipped. Tests: 350/350 pass (was 345, +5 new — round-trip, legacy passthrough, isLegacyPlaintext semantics, rotateLegacy idempotence). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: sync README + AGENTS + CLAUDE + CHANGELOG + OpenAPI for v1.3.3 (V3 audit doc-drift) V3 audit Doku Specialist findings — drift between code and meta-docs. - README §Key Features now mentions pulse oximetry (SpO₂) + Withings ScanWatch sync; Tech Stack model count corrected 23 → 25. - AGENTS.md status promoted v1.3.2 → v1.3.3; vitest config corrected `vitest.config.ts` → `vitest.config.mts`; migration range corrected `0001–0022` → `0001–0024`; model count + list updated to 25 (adds Device, IdempotencyKey). - CLAUDE.md model count updated (2 occurrences). - CHANGELOG.md v1.3.3 expanded with Security + Internal sections that were missing the audit-fix-marathon work (Bearer-scope, account-delete cascade, moodLog encryption, CSP tightening, Web-Push SSRF, IP-geo HTTPS, AI-test leak fix, import rate-limit, trusted-proxy XFF, audit-log retention, idempotency cachable filter, Bearer mock tightening, enum-drift cousins, PDF text-content tests). - OpenAPI Bearer description corrected `SHA-256 hashes` → `HMAC-SHA-256 hashes (keyed with API_TOKEN_HMAC_KEY)` so the docs match the actual server-side implementation. Wildcard scope contract documented. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(audit-review): close 4 HIGH + 2 MEDIUM findings from multi-agent review pass Multi-agent review of the audit-fix branch surfaced four HIGH issues and a couple of MEDIUM hardenings. All addressed before merge. HIGH-1 — OpenAPI MetricKind enum drift (iOS strict-decode crash risk). The dashboard-summary route now emits totalBodyWater/boneMass/ oxygenSaturation MetricCards, but the spec still listed only the original 7 kinds. Generated iOS Codable would have crashed the dash the moment a user logged SpO2. MetricKind extended with the 3 new kinds + comment documenting unknown-value defensive decoding. HIGH-2 — kindEnum naming consistency on /api/measurements/series. The series adapter shipped "oxygen" while the dashboard summary used "oxygenSaturation"; both routes now use "oxygenSaturation" so iOS decoders can share a single MetricKind type across endpoints. HIGH-3 — /api/ai/test no-leak guard had no test. Added 4 tests that mock provider errors with sk-leaked-key + provider URLs in the err fields and assert the response body never echoes them, plus the 3-status-categorised generic messages (401/429/5xx/other). HIGH-4 — /api/import 5/hour rate-limit had no test. Added 2 tests that mock checkRateLimit allowed/disallowed and assert the 429 path uses the right key shape (`import:<userId>`, 5, 1h) and that the within- quota path proceeds. MEDIUM-3 — getClientIp under-length XFF chain regression. With TRUST_PROXY_HOPS=2 and a chain of length 1, the previous clamp returned the leftmost (attacker-controlled) entry, silently re-introducing the rotation attack the helper was meant to close. Now: when chain is shorter than configured hops, refuse XFF entirely (fall back to x-real-ip / null). Added regression test. LOW-1 — TRUST_PROXY_HOPS=garbage now throws at boot instead of silently degrading to hops=0. Added regression test. Tests: 358/358 pass (was 350, +8 new). Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-11-12 22:26:13 +00:00 · 2026-05-08 01:05:56 +02:00
1 parent b76d579717
commit 98a57eb786
@@ -0,0 +1,94 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// Mocks must be hoisted before importing the route.
+vi.mock("@/lib/api-handler", () => ({
+  apiHandler: <T extends (...args: unknown[]) => unknown>(fn: T) => fn,
+  requireAuth: vi.fn(async () => ({ user: { id: "u-1" }, session: { id: "s-1" } })),
+}));
+
+vi.mock("@/lib/ai/provider", () => ({
+  resolveProvider: vi.fn(),
+}));
+
+vi.mock("@/lib/rate-limit", () => ({
+  checkRateLimit: vi.fn(async () => ({ allowed: true })),
+}));
+
+vi.mock("@/lib/logging/context", () => ({
+  annotate: vi.fn(),
+}));
+
+import { POST } from "../route";
+import { resolveProvider } from "@/lib/ai/provider";
+
+beforeEach(() => {
+  vi.resetAllMocks();
+});
+
+interface ApiErrorEnvelope {
+  data: null;
+  error: string;
+}
+
+// V3 audit: /api/ai/test was returning provider err.message + bodyExcerpt
+// directly to the client, leaking provider URLs / partial keys / internal
+// headers. Server now logs full details via annotate() and responds with
+// a categorised, generic message.
+describe("POST /api/ai/test — provider error leak guard", () => {
+  function makeProviderThatThrows(
+    err: Error & { httpStatus?: number; bodyExcerpt?: string },
+  ) {
+    vi.mocked(resolveProvider).mockResolvedValue({
+      type: "openai",
+      generateCompletion: vi.fn(async () => {
+        throw err;
+      }),
+    } as never);
+  }
+
+  it("does not echo provider err.message back to the client (HIGH coverage gap)", async () => {
+    const err = Object.assign(
+      new Error("OpenAI 401 from https://api.openai.com/v1 sk-leaked-key"),
+      { httpStatus: 401 as const, bodyExcerpt: '{"error":"invalid api key sk-secret"}' },
+    );
+    makeProviderThatThrows(err);
+
+    const response = await POST();
+    const body = (await response.json()) as ApiErrorEnvelope;
+
+    expect(response.status).toBe(502);
+    expect(body.error ?? "").not.toMatch(/sk-/);
+    expect(body.error ?? "").not.toMatch(/api\.openai\.com/);
+    expect(body.error ?? "").not.toMatch(/invalid api key/i);
+    expect(body.error).toBe("Provider rejected the credentials");
+  });
+
+  it("returns the 429-categorised message when the provider rate-limits", async () => {
+    makeProviderThatThrows(
+      Object.assign(new Error("429 from openai"), { httpStatus: 429 as const }),
+    );
+    const response = await POST();
+    expect(response.status).toBe(502);
+    expect(((await response.json()) as ApiErrorEnvelope).error).toBe(
+      "Provider rate-limited the request",
+    );
+  });
+
+  it("returns the 5xx-categorised message when the provider has a server error", async () => {
+    makeProviderThatThrows(
+      Object.assign(new Error("503 upstream"), { httpStatus: 503 as const }),
+    );
+    const response = await POST();
+    expect(((await response.json()) as ApiErrorEnvelope).error).toBe(
+      "Provider returned a server error",
+    );
+  });
+
+  it("returns the unknown-error fallback otherwise", async () => {
+    makeProviderThatThrows(new Error("ECONNRESET"));
+    const response = await POST();
+    expect(((await response.json()) as ApiErrorEnvelope).error).toBe(
+      "Provider connection failed",
+    );
+  });
+});
@@ -34,10 +34,28 @@ export const POST = apiHandler(async () => {
      sample: result.content.slice(0, 200),
    });
  } catch (e) {
+    // V3 audit: do not return provider error message + bodyExcerpt to the
+    // client (leaks provider URL / partial keys / internal headers).
+    // Log full details server-side for the operator and respond with a
+    // categorised, generic message.
    const err = e as Error & { httpStatus?: number; bodyExcerpt?: string };
-    return apiError(
-      `${err.message}${err.bodyExcerpt ? ` — ${err.bodyExcerpt.slice(0, 200)}` : ""}`,
-      502,
-    );
+    annotate({
+      meta: {
+        ai_test_error: err.message.slice(0, 500),
+        ai_test_status: err.httpStatus ?? null,
+        ai_test_body_excerpt: err.bodyExcerpt?.slice(0, 500) ?? null,
+        ai_test_provider: provider.type,
+      },
+    });
+    const status = err.httpStatus ?? 0;
+    const safeMessage =
+      status === 401 || status === 403
+        ? "Provider rejected the credentials"
+        : status === 429
+          ? "Provider rate-limited the request"
+          : status >= 500
+            ? "Provider returned a server error"
+            : "Provider connection failed";
+    return apiError(safeMessage, 502);
  }
 });
@@ -5,6 +5,7 @@ import { apiSuccess } from "@/lib/api-response";
 import { summarize, type DataPoint } from "@/lib/analytics/trends";
 import { getBpTargets } from "@/lib/analytics/bp-targets";
 import type { MeasurementType } from "@/generated/prisma/client";
+import { measurementTypeEnum } from "@/lib/validations/measurement";

 export const dynamic = "force-dynamic";

@@ -12,16 +13,9 @@ export const GET = apiHandler(async () => {
  const { user } = await requireAuth();
  annotate({ action: { name: "analytics.get" } });

-  const types: MeasurementType[] = [
-    "WEIGHT",
-    "BLOOD_PRESSURE_SYS",
-    "BLOOD_PRESSURE_DIA",
-    "PULSE",
-    "BODY_FAT",
-    "SLEEP_DURATION",
-    "ACTIVITY_STEPS",
-    "BLOOD_GLUCOSE",
-  ];
+  // Derived from canonical enum so a new measurement type is auto-summarised
+  // by /api/analytics (V3 audit: enum drift cousins).
+  const types = [...measurementTypeEnum.options] as MeasurementType[];

  const measurementsByType = await Promise.all(
    types.map((type) =>
@@ -14,6 +14,7 @@ import { apiSuccess } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { prisma } from "@/lib/db";
 import type { MeasurementType } from "@/generated/prisma/client";
+import { measurementTypeEnum } from "@/lib/validations/measurement";

 const SPARK_DAYS = 7;
 const STREAK_WINDOW_DAYS = 365;
@@ -25,7 +26,10 @@ type MetricKind =
  | "bodyFat"
  | "glucose"
  | "sleep"
-  | "steps";
+  | "steps"
+  | "totalBodyWater"
+  | "boneMass"
+  | "oxygenSaturation";

 interface MetricCard {
  id: string;
@@ -47,6 +51,9 @@ const METRIC_TITLES: Record<MetricKind, string> = {
  glucose: "Blutzucker",
  sleep: "Schlaf",
  steps: "Schritte",
+  totalBodyWater: "Gesamtkörperwasser",
+  boneMass: "Knochenmasse",
+  oxygenSaturation: "Sauerstoffsättigung",
 };

 const METRIC_UNITS: Record<MetricKind, string> = {
@@ -57,6 +64,9 @@ const METRIC_UNITS: Record<MetricKind, string> = {
  glucose: "mg/dL",
  sleep: "h",
  steps: "Schritte",
+  totalBodyWater: "kg",
+  boneMass: "kg",
+  oxygenSaturation: "%",
 };

 function trendOf(values: number[]): MetricCard["trend"] {
@@ -142,16 +152,12 @@ export const GET = apiHandler(async () => {
  const todayStart = startOfDayBerlin(now);
  const todayEnd = new Date(todayStart.getTime() + 86_400_000);

-  const measurementTypes: MeasurementType[] = [
-    "WEIGHT",
-    "BLOOD_PRESSURE_SYS",
-    "BLOOD_PRESSURE_DIA",
-    "PULSE",
-    "BODY_FAT",
-    "BLOOD_GLUCOSE",
-    "SLEEP_DURATION",
-    "ACTIVITY_STEPS",
-  ];
+  // Derived from canonical enum so a new measurement type is auto-included
+  // (V3 audit: enum drift cousins). Per-kind display blocks below decide
+  // which types render as MetricCards.
+  const measurementTypes = [
+    ...measurementTypeEnum.options,
+  ] as MeasurementType[];

  const [recentMeasurements, todaysIntakes, streakActivity] =
    await Promise.all([
@@ -296,11 +302,14 @@ export const GET = apiHandler(async () => {
    }
  }

-  // Glucose / sleep / steps — only if data is present.
+  // Optional cards — only emitted if the user has data for that type.
  for (const [type, kind] of [
    ["BLOOD_GLUCOSE", "glucose"],
    ["SLEEP_DURATION", "sleep"],
    ["ACTIVITY_STEPS", "steps"],
+    ["TOTAL_BODY_WATER", "totalBodyWater"],
+    ["BONE_MASS", "boneMass"],
+    ["OXYGEN_SATURATION", "oxygenSaturation"],
  ] as const) {
    const latest = latestOf(type);
    if (!latest) continue;
@@ -32,6 +32,7 @@ const widgetIdEnum = z.enum([
  "totalBodyWater",
  "boneMass",
  "bpInTarget",
+  "oxygenSaturation",
 ]);

 const layoutSchema = z.object({
@@ -0,0 +1,85 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/api-handler", () => ({
+  apiHandler: <T extends (...args: unknown[]) => unknown>(fn: T) => fn,
+  requireAuth: vi.fn(async () => ({ user: { id: "u-1" }, session: { id: "s-1" } })),
+}));
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    measurement: { create: vi.fn() },
+    moodEntry: { create: vi.fn() },
+  },
+}));
+
+vi.mock("@/lib/rate-limit", () => ({
+  checkRateLimit: vi.fn(),
+}));
+
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/logging/context", () => ({
+  annotate: vi.fn(),
+}));
+
+import { NextRequest } from "next/server";
+import { POST } from "../route";
+import { checkRateLimit } from "@/lib/rate-limit";
+
+beforeEach(() => {
+  vi.resetAllMocks();
+});
+
+interface ApiErrorEnvelope {
+  data: null;
+  error: string;
+}
+
+// V3 audit: /api/import POST had no rate-limit. Bulk-injection vector
+// (max:10000 records per call). Now capped at 5/hour/user.
+describe("POST /api/import — rate-limit guard", () => {
+  it("returns 429 when the user has exhausted the 5/hour quota (HIGH coverage gap)", async () => {
+    vi.mocked(checkRateLimit).mockResolvedValue({
+      allowed: false,
+      remaining: 0,
+      resetAt: new Date(Date.now() + 1000),
+    } as never);
+
+    const response = await POST(
+      new NextRequest("http://localhost/api/import", {
+        method: "POST",
+        body: JSON.stringify({ measurements: [] }),
+        headers: { "content-type": "application/json" },
+      }),
+    );
+
+    expect(response.status).toBe(429);
+    const body = (await response.json()) as ApiErrorEnvelope;
+    expect(body.error).toMatch(/per hour/i);
+    expect(checkRateLimit).toHaveBeenCalledWith(
+      expect.stringContaining("import:u-1"),
+      5,
+      60 * 60 * 1000,
+    );
+  });
+
+  it("processes the request when within the quota", async () => {
+    vi.mocked(checkRateLimit).mockResolvedValue({
+      allowed: true,
+      remaining: 4,
+      resetAt: new Date(Date.now() + 1000),
+    } as never);
+
+    const response = await POST(
+      new NextRequest("http://localhost/api/import", {
+        method: "POST",
+        body: JSON.stringify({ measurements: [] }),
+        headers: { "content-type": "application/json" },
+      }),
+    );
+
+    expect(response.status).toBeLessThan(400);
+  });
+});
@@ -2,26 +2,27 @@ import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
-import { apiSuccess, getClientIp, safeJson } from "@/lib/api-response";
+import { apiSuccess, apiError, getClientIp, safeJson } from "@/lib/api-response";
+import { checkRateLimit } from "@/lib/rate-limit";
 import { NextRequest } from "next/server";
 import { z } from "zod/v4";

-import { validateMeasurementRange } from "@/lib/validations/measurement";
+import {
+  validateMeasurementRange,
+  measurementTypeEnum,
+  glucoseContextEnum,
+} from "@/lib/validations/measurement";

+// Derived from canonical enum so round-trip export → import covers every
+// type. Previous hardcoded subset silently dropped 4 of 11 types
+// (V3 audit: enum drift cousins).
 const measurementSchema = z
  .object({
-    type: z.enum([
-      "WEIGHT",
-      "BLOOD_PRESSURE_SYS",
-      "BLOOD_PRESSURE_DIA",
-      "PULSE",
-      "BODY_FAT",
-      "SLEEP_DURATION",
-      "ACTIVITY_STEPS",
-    ]),
+    type: measurementTypeEnum,
    value: z.number(),
    unit: z.string(),
    measuredAt: z.string().datetime(),
+    glucoseContext: glucoseContextEnum.optional(),
    source: z.string().optional(),
    notes: z.string().optional(),
  })
@@ -51,6 +52,14 @@ export const POST = apiHandler(async (request: NextRequest) => {
  const { user } = await requireAuth();
  annotate({ action: { name: "import.upload" } });

+  // V3 audit: bulk-injection vector unchecked. 5/hour matches the export
+  // limit (10/hour) but is tighter because import writes have a higher
+  // blast radius (DB writes vs. read-only export).
+  const rl = await checkRateLimit(`import:${user.id}`, 5, 60 * 60 * 1000);
+  if (!rl.allowed) {
+    return apiError("Maximum 5 imports per hour", 429);
+  }
+
  const { data: body, error: jsonError } = await safeJson(request);

  if (jsonError) return jsonError;
@@ -76,6 +85,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
            source: "IMPORT",
            measuredAt: new Date(m.measuredAt),
            notes: m.notes || null,
+            glucoseContext: m.glucoseContext ?? null,
          },
        });
        stats.measurements++;
@@ -62,7 +62,10 @@ export const POST = apiHandler(async (request: NextRequest) => {
    return apiError("Token expired", 401);
  }

-  if (!apiToken.permissions.includes("medication:ingest")) {
+  if (
+    !apiToken.permissions.includes("*") &&
+    !apiToken.permissions.includes("medication:ingest")
+  ) {
    return apiError("Insufficient permissions", 403);
  }

@@ -113,7 +116,10 @@ export const POST = apiHandler(async (request: NextRequest) => {
  }

  const medicationScope = `medication:${medication.id}:ingest`;
-  if (!apiToken.permissions.includes(medicationScope)) {
+  if (
+    !apiToken.permissions.includes("*") &&
+    !apiToken.permissions.includes(medicationScope)
+  ) {
    return apiError("API endpoint for this medication is disabled", 403);
  }

@@ -18,6 +18,7 @@ import { getMedicationCategories } from "@/lib/medication-category";
 import type { MeasurementType } from "@/generated/prisma/client";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { measurementTypeEnum } from "@/lib/validations/measurement";

 export const dynamic = "force-dynamic";

@@ -36,14 +37,9 @@ export const GET = apiHandler(async () => {
    },
  });

-  // Fetch all measurements (90 days)
-  const types: MeasurementType[] = [
-    "WEIGHT",
-    "BLOOD_PRESSURE_SYS",
-    "BLOOD_PRESSURE_DIA",
-    "PULSE",
-    "BODY_FAT",
-  ];
+  // Derived from canonical enum so adding a new measurement type does not
+  // require touching this file (V3 audit finding: enum drift cousins).
+  const types = [...measurementTypeEnum.options] as MeasurementType[];

  const allMeasurements = await prisma.measurement.findMany({
    where: { userId, type: { in: types }, measuredAt: { gte: ninetyDaysAgo } },
@@ -2,6 +2,7 @@ import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { apiSuccess } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
+import { readMoodLogSecret } from "@/lib/moodlog-secret";

 export const dynamic = "force-dynamic";

@@ -23,11 +24,15 @@ export const GET = apiHandler(async () => {
    where: { userId: user.id },
  });

+  // V3 audit STILL-V2-C-2: stored secret is now AES-GCM encrypted at rest.
+  // Decrypt for the user's settings page; legacy plaintext is also handled.
+  const webhookSecret = readMoodLogSecret(dbUser?.moodLogWebhookSecret ?? null);
+
  return apiSuccess({
    configured: Boolean(dbUser?.moodLogUrlEncrypted),
    enabled: dbUser?.moodLogEnabled ?? false,
    lastSyncedAt: dbUser?.moodLogLastSyncedAt ?? null,
    entryCount,
-    webhookSecret: dbUser?.moodLogWebhookSecret ?? null,
+    webhookSecret,
  });
 });
@@ -5,6 +5,7 @@ import { apiError } from "@/lib/api-response";
 import { checkRateLimit } from "@/lib/rate-limit";
 import { getClientIp } from "@/lib/api-response";
 import { moodLogWebhookPayloadSchema } from "@/lib/validations/moodlog";
+import { readMoodLogSecret } from "@/lib/moodlog-secret";
 import { apiHandler } from "@/lib/api-handler";
 import { annotate, getEvent } from "@/lib/logging/context";

@@ -44,10 +45,14 @@ export const POST = apiHandler(async (request: NextRequest) => {
    select: { id: true, moodLogWebhookSecret: true },
  });

+  // V3 audit STILL-V2-C-2: stored secret is now encrypted at rest. Decrypt
+  // each candidate before the timing-safe compare. `readMoodLogSecret`
+  // also tolerates legacy plaintext rows during the transition window.
  const receivedBuf = Buffer.from(webhookSecret, "utf8");
  const user = candidates.find((c) => {
-    if (!c.moodLogWebhookSecret) return false;
-    const expectedBuf = Buffer.from(c.moodLogWebhookSecret, "utf8");
+    const expected = readMoodLogSecret(c.moodLogWebhookSecret);
+    if (!expected) return false;
+    const expectedBuf = Buffer.from(expected, "utf8");
    if (expectedBuf.length !== receivedBuf.length) return false;
    return timingSafeEqual(expectedBuf, receivedBuf);
  });
@@ -25,6 +25,9 @@ const kindEnum = z.enum([
  "glucose",
  "sleep",
  "steps",
+  "totalBodyWater",
+  "boneMass",
+  "oxygenSaturation",
 ]);

 const querySchema = z.object({
@@ -40,6 +43,9 @@ const KIND_TO_TYPE: Record<z.infer<typeof kindEnum>, MeasurementType> = {
  glucose: "BLOOD_GLUCOSE",
  sleep: "SLEEP_DURATION",
  steps: "ACTIVITY_STEPS",
+  totalBodyWater: "TOTAL_BODY_WATER",
+  boneMass: "BONE_MASS",
+  oxygenSaturation: "OXYGEN_SATURATION",
 };

 interface SeriesPoint {
@@ -44,7 +44,9 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
  const userId = user.id;
  const username = user.username;

-  // Log before deletion (userId will be SetNull in audit_logs after cascade)
+  // Log BEFORE deletion. The audit row's userId is SetNull post-cascade
+  // (per schema), but we then immediately purge it below for GDPR Art. 17
+  // erasure completeness — see comment further down.
  await auditLog("user.account.delete", {
    userId,
    ipAddress: getClientIp(request),
@@ -54,7 +56,15 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
  // Destroy all sessions first
  await destroyAllSessions(userId);

-  // Delete user — all related data is removed via onDelete: Cascade
+  // Audit V3 NEW-V3-2 / GDPR Art. 17 fix: Feedback and AuditLog rows have
+  // `onDelete: SetNull` in the schema, which keeps PII (free-text symptom
+  // descriptions, IP addresses, login city geo) attached to the record after
+  // the user is deleted. We explicitly purge them inside the same logical
+  // operation so account deletion is genuinely complete erasure.
+  await prisma.feedback.deleteMany({ where: { userId } });
+  await prisma.auditLog.deleteMany({ where: { userId } });
+
+  // Delete user — all other related data is removed via onDelete: Cascade
  await prisma.user.delete({ where: { id: userId } });

  annotate({
@@ -3,6 +3,10 @@ import { randomBytes } from "node:crypto";
 import { prisma } from "@/lib/db";
 import { apiSuccess, apiError } from "@/lib/api-response";
 import { encrypt } from "@/lib/crypto";
+import {
+  encryptMoodLogSecret,
+  readMoodLogSecret,
+} from "@/lib/moodlog-secret";
 import { moodLogCredentialsSchema } from "@/lib/validations/moodlog";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
@@ -26,14 +30,16 @@ export const PUT = apiHandler(async (request: NextRequest) => {

  const { url, apiKey } = parsed.data;

-  // Generate webhook secret if not yet set
+  // Generate webhook secret if not yet set; otherwise reuse the existing
+  // one (decrypted from at-rest storage; legacy plaintext is also handled).
  const existing = await prisma.user.findUnique({
    where: { id: user.id },
    select: { moodLogWebhookSecret: true },
  });

  const webhookSecret =
-    existing?.moodLogWebhookSecret ?? `mb_${randomBytes(32).toString("hex")}`;
+    readMoodLogSecret(existing?.moodLogWebhookSecret ?? null) ??
+    `mb_${randomBytes(32).toString("hex")}`;

  await prisma.user.update({
    where: { id: user.id },
@@ -41,7 +47,10 @@ export const PUT = apiHandler(async (request: NextRequest) => {
      moodLogUrlEncrypted: encrypt(url),
      moodLogApiKeyEncrypted: encrypt(apiKey),
      moodLogEnabled: true,
-      moodLogWebhookSecret: webhookSecret,
+      // V3 audit STILL-V2-C-2: encrypt at rest with AES-256-GCM. A legacy
+      // plaintext value (rare) is rotated to the encrypted form on this
+      // write transparently.
+      moodLogWebhookSecret: encryptMoodLogSecret(webhookSecret),
    },
  });

@@ -7,14 +7,34 @@ import { NextRequest, NextResponse } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
 import { annotate, getEvent } from "@/lib/logging/context";

+/**
+ * Audit C-3 / phase P2: Withings legacy callback URLs include the shared
+ * secret as a `?secret=…` query param, which leaks into reverse-proxy
+ * access logs and any error-tracking pipeline that captures `request.url`
+ * (see `reportToGlitchtip`). New deployments should configure Withings to
+ * send the secret via the `X-Withings-Webhook-Secret` header instead.
+ *
+ * The query-param fallback stays for backwards compatibility with existing
+ * Withings configurations; remove once all integrators have migrated.
+ */
 function hasValidWebhookSecret(request: NextRequest): boolean {
  const expected = process.env.WITHINGS_WEBHOOK_SECRET;
  if (!expected) {
    getEvent()?.addWarning("WITHINGS_WEBHOOK_SECRET not configured");
    return false;
  }
-  const received = request.nextUrl.searchParams.get("secret");
+
+  const fromHeader = request.headers.get("x-withings-webhook-secret");
+  const fromQuery = request.nextUrl.searchParams.get("secret");
+  const received = fromHeader ?? fromQuery;
  if (!received) return false;
+
+  if (!fromHeader && fromQuery) {
+    getEvent()?.addWarning(
+      "withings webhook secret received via legacy URL query — migrate to X-Withings-Webhook-Secret header",
+    );
+  }
+
  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(received, "utf8");
  if (a.length !== b.length) return false;