v1.4.34 — apple-health import + reliability + web-freeze

The final functional web release before the iOS native client lands. Headline work: a streaming Apple Health `export.zip` importer for prospective iOS-migrating accounts, a server-side aggregation cache that collapses the three hottest dashboard reads onto in-process LRU slots with single-flight coalescing and per-user invalidation, a broader compliance classifier with a dedicated `early` bucket so ahead-of-window doses count as compliant, the Coach launch surface hoisted onto every authed page with a dashboard-hero CTA, and a trimmer Settings shelf that folds Sources into Targets. The release also lights up the `cache.<name>.outcome` annotation on the active wide event so production logs carry the cache hit-ratio signal without leaking userIds. ### Added - **Server-side aggregation cache.** A new `ServerCache<T>` primitive (`src/lib/cache/server-cache.ts`) extends the v1.4.33 Coach snapshot LRU shape into a reusable per-route layer with TTL expiry, capacity-bounded LRU eviction, single-flight read coalescing, and per-instance hit / miss / eviction / stampede counters. Wires the three hottest dashboard reads — `/api/analytics` (slim + default), `/api/gamification/achievements`, `/api/medications/intake?scope=compliance` — and bolts per-user invalidation onto every measurement / mood / medication / workout / dashboard-widget write endpoint so the next read paints fresh data instead of waiting out the TTL. Every cache hit / miss surfaces on the active wide event as `cache.<name>.outcome` + `cache.<name>.key_hash` so production logs carry the hit-ratio signal without leaking userIds. - **Apple Health `export.zip` import.** New endpoint `POST /api/import/apple-health-export` (synchronous multipart upload, asynchronous ingest via a dedicated pg-boss `apple-health-import` worker, per-`MeasurementType` ingestion stats). Streams the upload straight to disk so a multi-gigabyte export never lands in V8 heap, hashes the bytes inline for content-based idempotency, and unpacks `apple_health_export/export.xml` with a hand-rolled ZIP central-directory walker that handles Zip64 for archives past the 4 GB barrier. The parser folds every `<Record>`, `<Workout>`, `<Correlation>`, and `<ClinicalRecord>` into the existing `Measurement` and `Workout` row shapes — spot rows keyed by `HKMetadataKeyExternalUUID` (or a deterministic `sample:<sha256>` fallback), cumulative HK types collapsed into one `stats:<HKType>:<YYYY-MM-DD>` row per user-local day to match the iOS daily-aggregation convention. Live per-stage progress surfaces through `GET /api/import/apple-health-export/{jobId}/status`. An admin variant at `POST /api/admin/import-apple-health-export` imports on behalf of a target user (cookie-only `requireAdmin()` gate; Bearer tokens never elevate). - **`ImportJob` schema model + migration.** New Prisma model captures the per-upload state machine (`queued | unpacking | parsing | upserting | done | failed`), the content-hash for idempotency short-circuits, and the per-`MeasurementType` ingestion counters the status route surfaces back to the client. - **`lastSeenByType` on `/api/analytics`.** Both the slim (`?slice=summaries`) and default slices return a per-type `{ lastSeenAt, daysAgo }` map. The dashboard trend tiles wire 12 mounts to a new `tileStaleDays()` helper so an "X days / weeks / months ago" hint paints under any per-metric tile whose last sample crosses the 7-day floor. Six locales gained additive week / month plural keys; Polish uses the genitive-plural form that covers every non-1 count the bucket math can produce. - **Dashboard "Ask the coach" hero CTA.** A new pill next to the existing "Hinzufügen" / "Add" launches the Coach drawer directly from the dashboard hero. The `<CoachLaunchProvider>` hoisted from the insights layout to the auth shell so the drawer is reachable from every authed route; the floating action button stays scoped to `/insights/**` so it cannot distract on the dashboard. - **Shared achievements query hook.** `useAchievementsQuery()` centralises the three previous consumers — recent-achievements card, the `/achievements` mother page, and the unlock notifier — onto one TanStack queryKey + cache slot so dashboard cold mount fires the endpoint once instead of twice. - **Typed authed Cache-Control presets.** New `src/lib/http/cache-headers.ts` module exports `NO_STORE_BUT_BFCACHE = "private, max-age=0, must-revalidate"`, `SHORT_LIVED_PUBLIC`, and an `applyAuthedHeaders()` helper. The presets land at the framework level via a `next.config.ts` `headers()` rule that stamps the bfcache-friendly directive on every authed HTML response, restoring Chromium bfcache eligibility for in-app back / forward navigation. - **`scripts/print-bundle-report.mjs`.** Restores the at-a-glance "top client chunks by parsed size" signal Turbopack dropped from `next build`; reads `.next/analyze/client.json` (written by `@next/bundle-analyzer` when `pnpm analyze` runs with `ANALYZE=1`) and prints a sorted table plus totals. ### Changed - **Settings sidebar: "Sources" folded into "Targets & Sources".** Per-metric threshold ranges and per-metric source priority now share one `/settings/thresholds` page so the same metric's threshold and device-source preference sit together instead of one sidebar entry away. `/settings/sources` keeps a `permanentRedirect` so external bookmarks and docs links follow through unchanged. Section count: 11 → 10. - **Insights tab strip: vital pills collapse under a "Vitals" parent.** Five vital pills (HRV, Resting HR, Oxygen, Body Temperature, Active Energy) hide behind one parent pill that opens a popover sub-list. Parent-pill active state mirrors the URL so spatial orientation survives the collapse; each sub-page keeps its own URL and bookmark resolves unchanged. Strip footprint: 14 → 10 entries when every metric has data. - **Coolify env-var audit.** `mcp__coolify-apps01__env_vars` inspection captured the section-1 / section-2 duplicates that have accumulated under apps-01 since v1.3.1. Audit pinned at `.planning/round-v1434-iwa-coolify-env-audit.md`; no env-var deletes performed (operator action). ### Fixed - **Compliance classifier: early intakes count as compliant.** The classifier picked up a dedicated `early` bucket (window-start minus three hours through window-start), the `on_time` post-window tolerance widened from one hour to three hours, and the `late` band sits between the new `on_time` ceiling and the configurable `lateMinutes` knob. Heatmap consumers route the new bucket through the compliant path; the dedicated `early` counter rides on `DailyComplianceEntry` for downstream consumers that want to distinguish ahead-of-window from on-window intakes. - **Compliance heatmap fallback retired.** The v1.4.33 defensive `looksClassifierBug` fallthrough is gone now that the underlying classifier widening removes the every-dose-very-late mode the fallback covered. ### Performance - **`/api/gamification/achievements` consumer collapse.** Two of three previous consumers shared the same TanStack queryKey literal; the third carried a per-user discriminator so the cache treated it as a fresh slot. Dashboard cold mount fired the endpoint twice. Collapsing onto the shared hook trims that to a single request; with the new server-side cache slot warm, the duplicate-mount worst case rides single-flight coalescing. - **GHCR build fires once per release tag.** The `docker-publish.yml` workflow lost its `push.branches: [main]` trigger; the `:latest` raw-tag enable rule moved onto the tag ref so each release produces exactly one multi-arch build that refreshes both the semver tags and the `:latest` alias. - **NFT-trace warnings silenced.** `next.config.ts` gained an `outputFileTracingExcludes` block that narrows the Turbopack tracer away from the `MAXMIND_LICENSE_KEY` env-access path so the trace-report no longer warns on every dependent route file. ### Refactor - **Dashboard analytics consumers.** The two cards that previously decided their own freshness copy now lean on the typed `tileStaleDays()` helper and the additive `lastSeenByType` field on the analytics response. Mood and BD-Zielbereich tiles keep the default `null` because they have no underlying per-type freshness signal. ### Accessibility - **Dashboard hero CTA hits the WCAG 2.5.5 touch-target floor.** The new "Ask the coach" pill carries `min-h-11` on mobile and the matching `sm:min-h-9` desktop floor so the touch target stays above 44 px on the Pixel 5 boundary. - **Insights tab-strip Vitals parent reads correctly to assistive tech.** Parent pill carries `aria-current="page"` whenever the current URL matches one of its child vital sub-pages, plus a `data-slot="insights-tab-strip-group"` hook for visual-regression testing. ### Internal - **Two e2e flake windows tightened.** `onboarding-flicker` swapped its 12-sample 50 ms poll loop for a single Playwright auto-retrying `toBeHidden({ timeout: 700 })` assertion so the 1-2 ms race window between the analytics-pending shell and `useAuth().user` resolving collapses to a single retry slot. `mobile-viewport` dropped `nav a[href]` from the touch-target sweep (the bottom-nav owns its own WCAG spec) and gated the 44-px floor on `matchMedia('(min-width: 640px)').matches === false` so the Pixel 5 viewport never tripped into the `sm:` tier during WebKit render commits. - **Server-cache observability.** Every `cached()` invocation passes an `annotate` callback that lands two keys on the wide event: `cache.<name>.outcome` ∈ `{ hit | miss | stampede }` and `cache.<name>.key_hash` (non-reversible djb2 32-bit hash). Ops can grep `cache.analytics.outcome` over any time window to compute the hit ratio per deployment. - **AASA followups verified.** The v1.4.33 `/.well-known/apple-app-site-association` handler serves a direct 200 on every fronting origin; Apple's CDN has ingested matching bodies for all three domains. ### Web freeze v1.4.34 marks the last functional release of the web codebase before the iOS native client launches. Subsequent v1.4.x tags carry security fixes, dependency bumps, and hotfix-only corrections. New feature work is paused until the iOS app clears Apple review, at which point a v1.5.0 version-bump-only release tags the milestone. The Prisma schema head comment and `.planning/v15-strategic-plan.md` §5 decision-log row pin the freeze trigger in-tree.
2026-11-13 22:32:04 +00:00 · 2026-05-16 21:25:26 +02:00
1 parent 7bef199039
commit affede31a4
@@ -0,0 +1,130 @@
+/**
+ * Smoke tests for the admin Apple Health import endpoint. Covers the
+ * cookie-only `requireAdmin()` gate (Bearer never elevates), the 413
+ * size-cap, and the 429 rate-limit path. Multipart streaming + boss
+ * enqueue are exercised by the parser + multipart unit suites.
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextRequest } from "next/server";
+
+vi.mock("@/lib/auth/session", () => ({ getSession: vi.fn() }));
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
+vi.mock("@/lib/db-compat", () => ({
+  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => ({ get: () => null })),
+  cookies: vi.fn(async () => ({
+    get: () => undefined,
+    set: () => {},
+    delete: () => {},
+  })),
+}));
+
+const mocks = vi.hoisted(() => ({
+  checkRateLimit: vi.fn().mockResolvedValue({ allowed: true }),
+  bossSend: vi.fn().mockResolvedValue("boss-job-1"),
+  getGlobalBoss: vi.fn(),
+  importJobCreate: vi.fn(),
+  importJobFindFirst: vi.fn().mockResolvedValue(null),
+  importJobUpdate: vi.fn(),
+  userFindUnique: vi.fn(),
+}));
+
+vi.mock("@/lib/rate-limit", () => ({
+  checkRateLimit: mocks.checkRateLimit,
+}));
+
+vi.mock("@/lib/jobs/boss-instance", () => ({
+  getGlobalBoss: mocks.getGlobalBoss,
+}));
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    importJob: {
+      create: mocks.importJobCreate,
+      findFirst: mocks.importJobFindFirst,
+      update: mocks.importJobUpdate,
+    },
+    user: {
+      findUnique: mocks.userFindUnique,
+    },
+  },
+}));
+
+import { POST } from "../route";
+import { getSession } from "@/lib/auth/session";
+
+const ADMIN_SESSION = {
+  session: { id: "sess-admin", expiresAt: new Date(Date.now() + 3_600_000) },
+  user: { id: "admin-1", username: "marc", role: "ADMIN" as const },
+};
+const USER_SESSION = {
+  session: { id: "sess-user", expiresAt: new Date(Date.now() + 3_600_000) },
+  user: { id: "user-2", username: "alice", role: "USER" as const },
+};
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  mocks.checkRateLimit.mockResolvedValue({ allowed: true });
+  mocks.bossSend.mockResolvedValue("boss-job-1");
+  mocks.getGlobalBoss.mockReturnValue({ send: mocks.bossSend });
+  mocks.importJobCreate.mockResolvedValue({ id: "ij-1" });
+  mocks.importJobFindFirst.mockResolvedValue(null);
+  mocks.importJobUpdate.mockResolvedValue({ id: "ij-1" });
+  mocks.userFindUnique.mockResolvedValue({ id: "user-2", username: "alice" });
+});
+
+describe("POST /api/admin/import-apple-health-export", () => {
+  it("returns 401 when unauthenticated", async () => {
+    vi.mocked(getSession).mockResolvedValue(null);
+    const req = new NextRequest("http://localhost/api/admin/import-apple-health-export", {
+      method: "POST",
+      headers: { "content-type": "multipart/form-data; boundary=---x" },
+      body: "stub",
+    });
+    const res = await POST(req);
+    expect(res.status).toBe(401);
+  });
+
+  it("returns 403 when a non-admin cookie session calls the route", async () => {
+    vi.mocked(getSession).mockResolvedValue(USER_SESSION as never);
+    const req = new NextRequest("http://localhost/api/admin/import-apple-health-export", {
+      method: "POST",
+      headers: { "content-type": "multipart/form-data; boundary=---x" },
+      body: "stub",
+    });
+    const res = await POST(req);
+    expect(res.status).toBe(403);
+  });
+
+  it("returns 413 when Content-Length exceeds the cap", async () => {
+    vi.mocked(getSession).mockResolvedValue(ADMIN_SESSION as never);
+    const headers = new Headers({
+      "content-type": "multipart/form-data; boundary=---x",
+      "content-length": String(2 * 1024 * 1024 * 1024),
+    });
+    const req = new NextRequest("http://localhost/api/admin/import-apple-health-export", {
+      method: "POST",
+      headers,
+      body: "stub",
+    });
+    const res = await POST(req);
+    expect(res.status).toBe(413);
+  });
+
+  it("returns 429 on rate-limit exhaustion", async () => {
+    vi.mocked(getSession).mockResolvedValue(ADMIN_SESSION as never);
+    mocks.checkRateLimit.mockResolvedValueOnce({ allowed: false });
+    const req = new NextRequest("http://localhost/api/admin/import-apple-health-export", {
+      method: "POST",
+      headers: { "content-type": "multipart/form-data; boundary=---x" },
+      body: "stub",
+    });
+    const res = await POST(req);
+    expect(res.status).toBe(429);
+  });
+});
@@ -0,0 +1,192 @@
+/**
+ * `POST /api/admin/import-apple-health-export` — admin-only Apple
+ * Health import on behalf of a target user.
+ *
+ * Same multipart streaming path as the user-facing kick-off, but with
+ * `requireAdmin()` (cookie-only — Bearer tokens never elevate) and a
+ * `userId` text field naming the target user. The kicked-off
+ * `ImportJob` row carries `triggeredByAdminId = admin.id` so the
+ * status endpoint admits both the target user AND the triggering
+ * admin.
+ *
+ * Locks per `.planning/research/v1434-r-1-xml-import.md` §9.
+ */
+import type { NextRequest } from "next/server";
+
+import { prisma } from "@/lib/db";
+import { apiHandler, requireAdmin, HttpError } from "@/lib/api-handler";
+import { apiError, apiSuccess, getClientIp } from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { auditLog } from "@/lib/auth/audit";
+import { checkRateLimit } from "@/lib/rate-limit";
+import { getGlobalBoss } from "@/lib/jobs/boss-instance";
+import {
+  APPLE_HEALTH_IMPORT_QUEUE,
+  type AppleHealthImportPayload,
+} from "@/lib/jobs/apple-health-import-worker";
+import { streamMultipartToDisk } from "@/lib/multipart/stream-to-disk";
+
+export const dynamic = "force-dynamic";
+
+const MAX_UPLOAD_BYTES = 1.5 * 1024 * 1024 * 1024;
+const RATE_LIMIT_MAX = 3;
+const RATE_LIMIT_WINDOW_MS = 60_000;
+
+export const POST = apiHandler(async (request: NextRequest) => {
+  const { user: admin } = await requireAdmin();
+  annotate({ action: { name: "admin.import-apple-health.kickoff" } });
+
+  const rl = await checkRateLimit(
+    `admin-import-apple-health:${admin.id}`,
+    RATE_LIMIT_MAX,
+    RATE_LIMIT_WINDOW_MS,
+  );
+  if (!rl.allowed) {
+    throw new HttpError(429, "Too many import uploads, try again later");
+  }
+
+  const declaredBytes = Number(request.headers.get("content-length") ?? 0);
+  if (declaredBytes > MAX_UPLOAD_BYTES) {
+    await auditLog("admin.import-apple-health.kickoff.denied", {
+      userId: admin.id,
+      ipAddress: getClientIp(request),
+      details: {
+        reason: "content_length_exceeded",
+        contentLength: declaredBytes,
+      },
+    });
+    return apiError("Upload exceeds 1.5 GB limit", 413);
+  }
+
+  const body = request.body;
+  if (!body) {
+    return apiError("Request body is required", 400);
+  }
+
+  let uploaded;
+  try {
+    uploaded = await streamMultipartToDisk(
+      body,
+      request.headers.get("content-type"),
+      {
+        maxBytes: MAX_UPLOAD_BYTES,
+        fieldName: "file",
+        tmpPrefix: "healthlog-admin-apple-health-import",
+      },
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "upload_failed";
+    await auditLog("admin.import-apple-health.kickoff.denied", {
+      userId: admin.id,
+      ipAddress: getClientIp(request),
+      details: { reason: "stream_to_disk_failed", message },
+    });
+    return apiError(`Multipart upload failed: ${message}`, 422);
+  }
+
+  // Resolve the target user from the multipart text field. Mandatory:
+  // the admin variant is explicitly cross-user.
+  const targetUserId = uploaded.textFields.userId;
+  if (!targetUserId) {
+    await auditLog("admin.import-apple-health.kickoff.denied", {
+      userId: admin.id,
+      ipAddress: getClientIp(request),
+      details: { reason: "missing_user_id" },
+    });
+    return apiError("Multipart field 'userId' is required", 422);
+  }
+
+  const targetUser = await prisma.user.findUnique({
+    where: { id: targetUserId },
+    select: { id: true, username: true },
+  });
+  if (!targetUser) {
+    await auditLog("admin.import-apple-health.kickoff.denied", {
+      userId: admin.id,
+      ipAddress: getClientIp(request),
+      details: { reason: "target_user_missing", targetUserId },
+    });
+    return apiError(
+      `Target user '${targetUserId}' does not exist`,
+      422,
+    );
+  }
+
+  // Same content-hash idempotency as the user-facing route, but scoped
+  // by the target user — an admin re-uploading the same file for the
+  // same user resolves to the previous job.
+  const existing = await prisma.importJob.findFirst({
+    where: {
+      userId: targetUser.id,
+      uploadSha256: uploaded.sha256,
+    },
+    orderBy: { startedAt: "desc" },
+  });
+  if (existing) {
+    annotate({ meta: { idempotent_hit: true, job_id: existing.id } });
+    return apiSuccess(
+      {
+        jobId: existing.id,
+        status: existing.status,
+        idempotent: true,
+      },
+      202,
+    );
+  }
+
+  const boss = getGlobalBoss();
+  if (!boss) {
+    await auditLog("admin.import-apple-health.kickoff.denied", {
+      userId: admin.id,
+      ipAddress: getClientIp(request),
+      details: { reason: "worker_not_running" },
+    });
+    throw new HttpError(503, "Background worker is not running");
+  }
+
+  const importJob = await prisma.importJob.create({
+    data: {
+      userId: targetUser.id,
+      triggeredByAdminId: admin.id,
+      status: "queued",
+      uploadBytes: uploaded.bytes,
+      uploadSha256: uploaded.sha256,
+    },
+  });
+
+  const payload: AppleHealthImportPayload = {
+    userId: targetUser.id,
+    triggeredByAdminId: admin.id,
+    uploadPath: uploaded.filePath,
+    uploadBytes: uploaded.bytes,
+    enqueuedAt: new Date().toISOString(),
+  };
+  const bossJobId = await boss.send(APPLE_HEALTH_IMPORT_QUEUE, payload);
+
+  await prisma.importJob.update({
+    where: { id: importJob.id },
+    data: { pgBossJobId: bossJobId },
+  });
+
+  await auditLog("admin.import-apple-health.kickoff", {
+    userId: admin.id,
+    ipAddress: getClientIp(request),
+    details: {
+      jobId: importJob.id,
+      bossJobId: bossJobId ?? null,
+      targetUserId: targetUser.id,
+      targetUsername: targetUser.username,
+      uploadBytes: uploaded.bytes,
+      uploadSha256: uploaded.sha256,
+    },
+  });
+
+  return apiSuccess(
+    {
+      jobId: importJob.id,
+      status: "queued" as const,
+      targetUserId: targetUser.id,
+    },
+    202,
+  );
+});
@@ -15,6 +15,7 @@ import {
  invalidateServerDefaultTimezone,
  isValidTimezone,
 } from "@/lib/tz/resolver";
+import { invalidateAppSettings } from "@/lib/cache/invalidate";

 export const dynamic = "force-dynamic";

@@ -228,6 +229,11 @@ export const PUT = apiHandler(async (request: NextRequest) => {
    invalidateServerDefaultTimezone();
  }

+  // v1.4.34 IW-G — bust the bug-report status cache (global singleton)
+  // so the next read reflects the new GitHub-token / bug-report-enabled
+  // shape. Cheap call — the cache holds at most 10 entries.
+  invalidateAppSettings();
+
  await auditLog("admin.settings.update", {
    userId: user.id,
    ipAddress: getClientIp(request),