Merge remote-tracking branch 'origin/main' into feat/v140-fixes

# Conflicts:
#	docs/api/openapi.yaml

src/__tests__/api/auth/registration-status/route.test.ts

@@ -114,3 +114,30 @@ describe("GET /api/auth/registration-status", () => {
     expect(body.data.registrationEnabled).toBe(false);
   });
 });
+
+describe("GET /api/auth/registration-status — sessionCookieSecure (#1097)", () => {
+  it("publishes whether the server issues Secure session cookies, on every branch", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: true,
+    } as never);
+    vi.stubEnv("SESSION_COOKIE_SECURE", "true");
+    let body = await (await callGet()).json();
+    expect(body.data.sessionCookieSecure).toBe(true);
+
+    vi.stubEnv("SESSION_COOKIE_SECURE", "false");
+    body = await (await callGet()).json();
+    expect(body.data.sessionCookieSecure).toBe(false);
+
+    vi.mocked(prisma.appSettings.findUnique).mockRejectedValue(
+      new Error("db down"),
+    );
+    vi.stubEnv("SESSION_COOKIE_SECURE", "true");
+    body = await (await callGet()).json();
+    expect(body.data).toEqual({
+      registrationEnabled: false,
+      sessionCookieSecure: true,
+    });
+    vi.unstubAllEnvs();
+  });
+});

src/__tests__/openapi-route-coverage-guard.test.ts

@@ -239,6 +239,18 @@ const UNPUBLISHED: Readonly<Record<string, Exemption>> = {
     kind: "adminConsole",
     methods: ["POST"],
   },
+  "/api/admin/encryption/key-backup": {
+    kind: "adminConsole",
+    methods: ["GET"],
+  },
+  "/api/admin/encryption/key-backup/confirm": {
+    kind: "adminConsole",
+    methods: ["POST"],
+  },
+  "/api/admin/encryption/key-backup/verify": {
+    kind: "adminConsole",
+    methods: ["POST"],
+  },
   "/api/admin/encryption/rotate": { kind: "adminConsole", methods: ["POST"] },
   "/api/admin/encryption/status": { kind: "adminConsole", methods: ["GET"] },
   "/api/admin/host-metrics": { kind: "adminConsole", methods: ["GET"] },

src/__tests__/published-env-reaches-the-container.test.ts

@@ -71,6 +71,11 @@ const MANIFEST_NAMES: string[] = (
  * entry a lie rather than an inconvenience.
  */
 const PUBLISHED_TO_USERS = [
+  {
+    name: "HEALTHLOG_PLATFORM",
+    shownBy:
+      "the admin's encryption key backup step, which opens on that platform",
+  },
   {
     name: "AUDIT_LOG_RETENTION_DAYS",
     shownBy: "the shared-access activity window and the revoke dialog",