tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-09 13:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,620 Commits 11 Branches 539 Tags
19590cd2164948c27d974cecb96a09ef73de31e7
Commit Graph
4620 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marc-André Bombeck 19590cd216 docs(01-13): complete Google sync contract plan 
- record expected-red and positive verification evidence
- preserve reporter-gated cause and immutable scanner boundaries
 2026-07-29 14:24:16 +02:00
Marc-André Bombeck 958b0e10d9 fix(01-11): keep reminder fixture type-safe 
- mutate the inferred schedule fixture without widening nullable fields
- preserve the cross-midnight RED expectation unchanged
 2026-07-29 14:24:00 +02:00
Marc-André Bombeck 25612294d1 test(01-11): pin rolling overdue consumer parity 
- compare persisted weekly occurrence across list, dashboard, GLP-1, and take-all
- protect exact intake retries and unrelated occurrence isolation
 2026-07-29 14:23:52 +02:00
Marc-André Bombeck 65ca1aae42 test(01-10): add red responsive navigation contracts 
- pin grouped and heading-aligned Settings and Admin sidebars
- add mobile Insights geometry and deterministic release evidence captures
 2026-07-29 14:22:54 +02:00
Marc-André Bombeck 6f84629482 test(01-13): add red Google sync terminal contracts 
- cover authenticated status polling and bounded resource outcomes
- prove committed workouts invalidate server and client cache surfaces
 2026-07-29 14:22:49 +02:00
Marc-André Bombeck b8766fa93b docs(01-12): complete Apple ECG contract plan 
- record expected RED archive and PostgreSQL boundaries
- preserve green WHOOP and source-agnostic regression evidence
 2026-07-29 14:22:08 +02:00
Marc-André Bombeck 6cc3de8248 test(01-12): add failing Apple ECG import contracts 
- pin bounded path-safe archive and parser behavior
- require encrypted idempotent fail-soft persistence and WHOOP regressions
 2026-07-29 14:20:56 +02:00
Marc-André Bombeck d5f473d672 test(01-11): specify rolling weekly overdue identity 
- pin the prior-day Mounjaro occurrence across local midnight and DST
- cover resolution state, band end, schedule siblings, and era isolation
 2026-07-29 14:19:03 +02:00
Marc-André Bombeck 18d0facdfe test(01-10): add red assessment and records contracts 
- pin honest assessment fallback, exhaustion, foreground, and state envelopes
- require consistent save and empty-state add action grammar
 2026-07-29 14:18:35 +02:00
Marc-André Bombeck d8e52b831d test(01-13): add red Google sync progress contracts 
- pin workout-first fairness and bounded resource outcomes
- require owner-scoped race-safe current-run progress in PostgreSQL
 2026-07-29 14:18:20 +02:00
Marc-André Bombeck 81893ac972 test(01-11): reproduce cross-midnight reminder identity bug 
- pin prior-day occurrence lookup across timezone and DST boundaries
- prove real worker dedup and distinct next-dose behavior with PostgreSQL
 2026-07-29 14:15:48 +02:00
Marc-André Bombeck 8e944dbcd3 test(01-10): add red dashboard and score presentation contracts 
- preserve useful Today narrative without duplicate score prose
- remove stored-document regeneration from the detail surface
- retain score identity while rejecting redundant method copy
 2026-07-29 14:12:58 +02:00
Marc-André Bombeck 44b5d8da17 docs(01-09): complete focused security gate plan 
- summarize zero-skip final-boundary security evidence
- record operator contracts, scope freeze, and command correction
 2026-07-29 14:12:52 +02:00
Marc-André Bombeck 56c20f26db docs(01-09): record corrected green security gate 
- adopt revised direct Vitest commands as authoritative evidence
- retain the obsolete wrapper failure as an audit trail
 2026-07-29 14:11:41 +02:00
Marc-André Bombeck fb95e3a134 docs(01-09): freeze post-security implementation scope 
- attest immutable scanner and package baseline equality
- defer Low findings, dependency work, and final scan to later gates
 2026-07-29 14:10:14 +02:00
Marc-André Bombeck 2409183588 test(01-09): record focused security gate evidence 
- map SEC-01 through SEC-08 to positive and attacker boundaries
- record green focused suites and the literal command blocker
 2026-07-29 14:09:30 +02:00
Marc-André Bombeck 9ea0cb867f docs(01-09): document security contract changes 
- define explicit MCP read scope boundaries and upgrade handling
- document Nightscout private-origin pinning and reset revocation
 2026-07-29 14:08:37 +02:00
Marc-André Bombeck ddbfcb4588 docs(01-07): complete SSRF policy plan 
- record exact-origin and IPv6 transition enforcement
- capture verification results and the scoped sync-route deviation
 2026-07-29 13:59:35 +02:00
Marc-André Bombeck 5b1e11d5af docs(01-08): complete passkey and recovery plan 
- record session-bound enrollment and atomic reset outcomes
- capture verification evidence, decisions, and blocking type correction
 2026-07-29 13:58:00 +02:00
Marc-André Bombeck 27a3e08436 fix(01-07): make private Nightscout access operator-owned 
- remove the user-facing private-host bypass
- render a redacted operator-action state for denied legacy connections
 2026-07-29 13:57:48 +02:00
Marc-André Bombeck f95da50ba0 fix(01-07): enforce exact Nightscout origins 
- move private-host authority to the server-owned exact-origin policy
- preserve stable redacted policy failures through connect and sync
 2026-07-29 13:57:07 +02:00
Marc-André Bombeck b7b18a6da2 fix(01-08): align passkey request fixture typing 
- construct NextRequest options with the framework-compatible init type
- preserve every enrollment security assertion unchanged
 2026-07-29 13:55:57 +02:00
Marc-André Bombeck 9c661dcc5e fix(01-08): revoke credentials atomically on password reset 
- lock the resolved account and rotate its password in one transaction
- revoke sessions, tokens, trusted devices, and elevations with rollback safety
 2026-07-29 13:55:11 +02:00
Marc-André Bombeck 7874eea04d feat(01-08): require reauthentication before passkey enrollment 
- offer password, TOTP, passkey, and security-key proof choices
- start registration only after the selected existing factor succeeds
 2026-07-29 13:53:59 +02:00
Marc-André Bombeck 89c83510d4 feat(01-08): bind passkey enrollment to fresh cookie proof 
- require an existing-factor proof before issuing registration options
- atomically claim session-bound challenges before credential persistence
 2026-07-29 13:52:22 +02:00
Marc-André Bombeck 9cb11abedb docs(01-05): complete MCP security enforcement plan 
- record green scope and PostgreSQL replay-family gates
- document transactional rotation and post-commit artifact semantics
 2026-07-29 13:52:03 +02:00
Marc-André Bombeck db08f6c175 fix(01-05): serialize MCP refresh families 
- lock and rotate refresh families inside one database transaction
- revoke CAS losers and insert successors before commit
- sign refresh artifacts only after committed state
 2026-07-29 13:50:14 +02:00
Marc-André Bombeck a177869609 fix(01-07): classify embedded IPv4 destinations 
- Normalize IPv6 literals before transition-prefix inspection
- Reject mapped, compatible, 6to4, and NAT64 private embeddings
- Share the verdict with pinned public and operator dispatchers
 2026-07-29 13:49:49 +02:00
Marc-André Bombeck 36cb64c840 test(01-02): exercise DNS transition cases past fetch port guard 
- replace blocked port 9 with non-blocked test port 8089
- preserve pre-connect ENOTFOUND assertions for all transition forms
 2026-07-29 13:49:46 +02:00
Marc-André Bombeck 20a6731c8b fix(01-05): enforce MCP health read scope 
- require health:read or wildcard for MCP read capability
- reject insufficient scopes before downstream gates and server construction
 2026-07-29 13:47:46 +02:00
Marc-André Bombeck 8ca6ebd773 docs(01-06): complete PWA cache isolation plan 
- document public-only install and data-free offline behavior
- record scoped current and legacy cache eviction
- capture green final-boundary and session-hook verification
 2026-07-29 13:47:17 +02:00
Marc-André Bombeck 338dbe6c1f fix(01-06): purge owned PWA caches on session end 
- delete current and legacy HealthLog static page and data caches
- preserve unrelated CacheStorage namespaces during activation and logout
- keep IndexedDB query-cache removal in the session-end boundary
 2026-07-29 13:46:15 +02:00
Marc-André Bombeck 31248ec273 docs(01-01): complete MCP security red contracts plan 
- record expected-red authorization and refresh-race evidence
- hand off exact enforcement targets to Plan 01-05
 2026-07-29 13:45:42 +02:00
Marc-André Bombeck 8851569658 fix(01-06): isolate PWA install from authenticated root 
- remove the dashboard root from immutable precaching
- evict same-version root entries left by older workers
- retain public logos and favicon for offline support
 2026-07-29 13:45:23 +02:00
Marc-André Bombeck 0c29e6e6b0 test(01-01): keep bearer regression lint-clean 
- avoid React hook-name classification for token fixture helpers
 2026-07-29 13:44:28 +02:00
Marc-André Bombeck 8b5e928efa docs(01-03): complete credential security contracts plan 
- document passkey enrollment and reset recovery RED boundaries
- record focused expected failures and green parity evidence
- preserve production, schema and scanner-owned files untouched
 2026-07-29 13:43:49 +02:00
Marc-André Bombeck 51f5f43957 test(01-01): preserve explicit transaction contract 
- keep the red transaction-client call aligned with the planned signature
- isolate the concurrent documentation commit from MCP test content
 2026-07-29 13:43:27 +02:00
Marc-André Bombeck 390c718b74 test(01-01): reproduce MCP refresh replay race 
- coordinate concurrent exchanges with a real PostgreSQL row-lock barrier
- verify family-wide successor revocation and cross-connection isolation
 2026-07-29 13:42:30 +02:00
Marc-André Bombeck cc8567d82f docs(01-02): complete PWA and SSRF red contracts plan 
- document expected cache-isolation and transition-form failures
- record preserved public and redirect behavior
- capture atomic task commits and verification evidence
 2026-07-29 13:42:30 +02:00
Marc-André Bombeck abea48026b test(01-03): add atomic reset revocation contracts 
- execute the operator CLI against real PostgreSQL credential tables
- require complete target revocation and unrelated-admin isolation
- force a mid-transaction database failure to prove rollback
 2026-07-29 13:42:04 +02:00
Marc-André Bombeck eb5cd5fbcb docs(01-04): complete Nightscout security contract plan 
Tasks completed: 3/3
- Specify exact operator-origin configuration
- Pin connect-time and sync-time egress policy
- Pin the user-facing breaking-change state
 2026-07-29 13:41:52 +02:00
Marc-André Bombeck 38501f6574 test(01-01): specify transactional refresh rotation 
- require one transaction for rotation and successor insertion
- pin CAS-loss revocation and insertion rollback semantics
 2026-07-29 13:40:03 +02:00
Marc-André Bombeck 3f4afb26a4 test(01-03): pin passkey enrollment reauthentication UX 
- require password, passkey, TOTP and WebAuthn proof choices
- order fresh-factor completion before challenge creation
- keep successful enrollment in one cookie-bound ceremony
 2026-07-29 13:39:55 +02:00
Marc-André Bombeck e25080b214 test(01-02): add red DNS-pinned SSRF contracts 
- refuse standard embedded-private IPv6 resolver answers pre-connect
- preserve public IPv6 to IPv4 fallback connectivity
- prove followed redirects repeat the pinned DNS verdict
 2026-07-29 13:39:52 +02:00
Marc-André Bombeck 5569b8259b test(01-04): pin Nightscout operator-action UI 
- Remove the user-facing private-host bypass contract
- Require redacted operator approval guidance for legacy failures
- Preserve usable public and approved-private connected states
 2026-07-29 13:39:50 +02:00
Marc-André Bombeck 14f451093e test(01-04): pin Nightscout egress enforcement 
- Deny user-authorized and mismatched private origins before network access
- Preserve exact operator-private and public positive flows
- Require stable redacted policy reasons through sync boundaries
 2026-07-29 13:39:06 +02:00
Marc-André Bombeck 9f6cd86c0d test(01-03): add passkey enrollment security contracts 
- require fresh existing-factor proof on both cookie-only legs
- bind registration challenges to user, purpose, session, expiry and one use
- cover bearer, ambient-cookie, stale, foreign and replay attacks
 2026-07-29 13:38:53 +02:00
Marc-André Bombeck 6c0f47acad test(01-01): pin MCP read scope boundaries 
- cover health read and wildcard positive capability paths
- reject unrelated scopes before server registration and database reads
 2026-07-29 13:38:41 +02:00
Marc-André Bombeck fb533147d3 test(01-02): add red IPv6 transition classifier matrix 
- cover mapped compatible 6to4 and NAT64 private embeddings
- exercise both literal URL and raw DNS address verdicts
- preserve public IPv4 native IPv6 and transition forms
 2026-07-29 13:38:11 +02:00
Marc-André Bombeck 3a813b51bd test(01-02): add red PWA cache isolation contracts 
- exercise signed-in service-worker install at CacheStorage boundary
- require data-free offline navigation and immutable public assets
- require current and legacy session cache cleanup
 2026-07-29 13:37:20 +02:00