mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-14 22:50:51 +00:00
2620064ef1d7d7acdd30902a6d1eb5b540565014
24
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Marc-André Bombeck
|
e060ab33a2 |
fix(integrations): silence the Withings scope-skip path from the 3-strike alert ladder
The v1.4.26 scope-skip short-circuit in `sync-activity.ts` and `sync-sleep.ts` called `recordSyncFailure` for a deliberate no-op, which incremented `IntegrationStatus.consecutiveFailures` and tripped the 3-strike admin Telegram alert for every legacy connection. Webhook deliveries (appli=16 / appli=44) could run the counter from 0 to 3 in seconds on a freshly-deployed v1.4.26 install, and pre-existing counters that survived the deploy (e.g. an 87-strike row from the pre-fix transient burst) paged immediately on the first scope-skip after the 24h re-alert window closed. Extract a new `parkIntegrationAtReauth` helper next to `recordSyncFailure` that sets the row to `error_reauth` without incrementing the counter, without writing an `integrations.sync.failed` audit row, and without entering the threshold ladder. A standalone `integrations.reauth_required` audit row is written on the first park so the operations trail still shows the event; re-parking the same scope-skip is idempotent (no extra audit write). Swap the two deliberate scope-skip call-sites in `withings/sync-activity.ts` and `withings/sync-sleep.ts` to the new helper. The defence-in-depth 403 catch-block in each sync routine stays on `recordSyncFailure` — a 403 reaching the catch IS genuinely unexpected once the scope-skip lands above, so the alert ladder should still fire on that asymmetric pair. BL-P3-2 parity verified between activity and sleep. Tests extended: - `integrations/__tests__/admin-alert.test.ts` adds a `parkIntegrationAtReauth` block asserting state=error_reauth without counter increment, no `dispatchNotification`, and audit-log idempotency on a second call. - `withings/__tests__/sync-activity.test.ts` + `withings/__tests__/sync-sleep.test.ts` swap their scope-skip assertions to `parkIntegrationAtReauth` and keep the 403 catch-block on `recordSyncFailure` to prove the defence-in-depth alert path survives. |
||
|
Marc-André Bombeck
|
fec02aa573 |
fix(withings): skip activity + sleep sync when OAuth scope lacks user.activity
Legacy v1.4.24-and-earlier Withings connections sit on `user.metrics`
only. W17b/c added `syncUserActivity` + `syncUserSleep` against the
scope-gated `/v2/measure?action=getactivity` and `/v2/sleep?action=get`
endpoints without a scope guard, so every cron tick for a legacy user
hit a guaranteed 403. The catch-block classified the 403 as transient
(the refresh token still worked; only the resource call failed), pg-boss
retried, and the 3-strike admin alert paged Telegram for every affected
user.
Both routines now short-circuit at entry: read `WithingsConnection.scope`,
call `hasActivityScope` from `src/lib/withings/client.ts`, and on miss
park at `error_reauth` via `recordSyncFailure({ kind: "reauth_required",
errorCode: "scope_missing" })` and return 0. The Settings reconnect
banner already in place tells the user what to do; subsequent cron ticks
short-circuit cheaply on `isReauthRequired`.
Defence-in-depth: a 403 reaching the catch-block (race where scope was
revoked between OAuth and the next sync without invalidating the refresh
token) now classifies as `reauth_required` instead of `transient`, so
pg-boss stops retrying and the 3-strike alert stays quiet.
Tests: +4 scope-skip / 403-classification cases per routine (8 total),
defaulting the existing field-mapping + idempotency tests to a
scope-is-fine connection so they stay focused on the write path.
|
||
|
Marc-André Bombeck
|
701fd5f251 |
fix(withings): anchor activity sync at noon UTC for tz-safe bucketing
Withings reports per-day aggregates with `date` as `YYYY-MM-DD`. The v1.4.25 W17b writer anchored `measuredAt` at the day's 23:59:59 UTC so the row would sort at the end of the day in chronological reads. That shape mis-bucketed positive-offset users: a row from `date=2026-05-12` arrived as 2026-05-13 08:59:59 in Tokyo, off-by-one for every dashboard tile that reads the row in user-local time. Anchor at noon UTC (`12:00:00Z`) instead — the standard "calendar-day with no clock" representation per RFC 3339 §5.6. The instant lands inside the local calendar day for every supported user timezone in the practical [-11, +12) range (Honolulu through Tokyo), so the analytics layer day-keys the row to the same calendar day every user reads it in. Regression test covers the four canonical user zones; the existing end-of-day assertion is updated. Fix-O / senior-M2. |
||
|
Marc-André Bombeck
|
b55942fd18 |
feat(jobs): pg-boss queues for activity-sync + sleep-v2-sync + webhook enqueue hooks
Two new pg-boss queues join the existing reminder-worker orchestrator: withings-activity-sync — cron '0 * * * *' (hourly at :00) withings-sleep-sync — cron '15 * * * *' (hourly at :15, offset) Each queue's handler dispatches per-user: when the payload carries `userId` (webhook-triggered) only that user syncs; when `userId` is absent (cron-triggered) the worker iterates every WithingsConnection. Per-user failures log as warnings so one parked-at-reauth connection doesn't starve the rest on a cron tick. The webhook handler now reads the `appli` form / JSON field and dispatches: appli=16 → enqueue withings-activity-sync (W17b) appli=44 → enqueue withings-sleep-sync (W17c) appli=1/2/4 or missing → legacy syncUserMeasurements (unchanged) When pg-boss is unavailable (dev server without the worker process) the handler falls back to inline sync so dev iteration isn't blocked on a separate worker process. The 15-minute cadence offset between activity (:00) and sleep (:15) keeps the two crons out of lockstep with the existing measure cron at :00, smoothing the load against the Withings 120-req/min/app cap. |
||
|
Marc-André Bombeck
|
9ae47dc80a |
feat(withings): sleep v2 sync — stage-level segments per night
New `syncUserSleep` routine pulls per-segment sleep data from POST /v2/sleep?action=get and writes one Measurement row per stage segment, tagged with the appropriate SleepStage enum: state 0 (awake) → AWAKE state 1 (light sleep) → CORE (HealthKit-aligned NREM 1+2) state 2 (deep sleep) → DEEP state 3 (REM) → REM state 4 (synthetic) → ignored The legacy ASLEEP and IN_BED enum slots stay reserved for HealthKit ingest (pre-iOS-16 `asleepUnspecified` and iOS-16+ `inBed`). ScanWatch nights with no REM segment simply omit the row rather than synthesising an all-zeros entry — Withings drops the field, the writer never sees it. Idempotency rides on Migration 0055's five-column composite — a re-sync of the same night UPDATEs every segment row in place rather than inserting duplicates, even when Withings re-aggregates the night with adjusted segment boundaries. Sleep durations stored as canonical minutes (seconds ÷ 60, rounded) so re-syncs don't flip values on floating-point noise. |
||
|
Marc-André Bombeck
|
128ee10e02 |
feat(withings): activity sync — steps + distance + active-energy from getactivity
New `syncUserActivity` routine pulls daily aggregates from POST /v2/measure?action=getactivity and writes one Measurement row per (date, metric) for three fields: steps → ACTIVITY_STEPS (count) distance → WALKING_RUNNING_DISTANCE (metres) calories → ACTIVE_ENERGY_BURNED (kcal) `elevation`, soft/moderate/intense/active duration and `totalcalories` are deliberately skipped — no clean MeasurementType counterpart today; revisit when v1.5 ships the iOS workout passthrough. Rows anchor measuredAt at the day's 23:59:59 UTC end-of-day so the Berlin-timezone analytics aggregator buckets them into the correct local day even across DST shifts. Idempotency rides on the W17b composite (Migration 0055, NULLS NOT DISTINCT) — repeat syncs of the same date update value in place rather than inserting duplicates. Park behaviour mirrors syncUserMeasurements: connections at error_reauth short-circuit without making the upstream call. |
||
|
Marc-André Bombeck
|
e504faa7b6 |
feat(withings): expand webhook subscriptions to activity + sleep v2
WITHINGS_NOTIFY_APPLIS grows from [1, 2, 4] to [1, 2, 4, 16, 44]: appli=16 (Activity) and appli=44 (Sleep v2) join the webhook-primary set so the new sync routines fire in seconds rather than waiting for the hourly cron fallback. setupWebhook iterates the new list unchanged — Withings has no batch subscribe endpoint, so every appli is its own POST. The two new categories require the user.activity OAuth scope from W5d; legacy connections that never reconnected return 503/293 on those subscribes, which setupWebhook already logs as a per-appli warning while keeping the remaining subscriptions live. |
||
|
Marc-André Bombeck
|
df5a82bc6f |
feat(schema): extend Measurement composite with sleepStage (Migration 0055)
The Withings Sleep v2 sync writes one Measurement row per stage segment (AWAKE | CORE | DEEP | REM) for the same night, all sharing the legacy four-column composite (user_id, type=SLEEP_DURATION, measured_at, source=WITHINGS). Migration 0055 adds sleep_stage as the fifth axis and recreates the unique index with NULLS NOT DISTINCT so non-sleep rows (sleep_stage IS NULL) still dedup on the first four columns — same effective semantics as before for every meastype other than SLEEP_DURATION. Prisma's generated compound input requires non-null fields, so the Withings sync's upsert is reshaped as findFirst + create/update for the non-sleep path (sleepStage is always NULL there). The new five-column upsert key is the canonical path for the Sleep v2 ingest landing in W17c. |
||
|
Marc-André Bombeck
|
a1ffa497f1 |
fix(security): Withings webhook secret as URL path segment, not query string
Move the Withings webhook shared secret from `?secret=…` to a path segment (`/api/withings/webhook/<secret>`) so it never lands in the reverse-proxy `query_string` access-log column or GlitchTip URL/ breadcrumb capture surface (W10 finding M-2). Withings has no facility for custom HTTP headers on outgoing notifications and never signs the body — every Notify.subscribe call accepts only action/callbackurl/appli/client_id/nonce/signature, so the callback URL is the only authenticity surface a subscriber controls. Path-segment binding is the largest practical shift away from loggable query strings that Withings supports end-to-end. The legacy `/api/withings/webhook` route stays alive for one release cycle (removal target: v1.4.27) so existing subscriptions keep delivering. The query-string path now emits a deprecation breadcrumb on every hit. Active users re-subscribe organically when they reconnect for the v1.4.25 `user.activity` OAuth-scope upgrade. Tests: 8 new for the path-segment route (valid / invalid / missing / unset-env / prefix-match / rate-limited / HEAD / GET), 3 new for `getWithingsWebhookCallbackUrl()`. Existing legacy-route tests continue to pass over the refactored shared helper. |
||
|
Marc-André Bombeck
|
98f7d11861 |
chore: resolve parallel-agent merge conflicts + sweep up loose edits
7 conflict files resolved by taking the upstream/HEAD side (which carries the W4d/W5/W6c/W3f feature additions). Stashed-side changes that were genuine new features re-land in subsequent commits if any were lost. This sweeps up the loose state the W4e+W5e+W5d combined agent left mid-stash. Resolves develop's working tree for clean push. |
||
|
Marc-André Bombeck
|
5a9612822e |
feat(withings): OAuth scope upgrade + reconnect banner
v1.4.25 W5d. The Withings Activity / Sleep endpoints sit behind the
`user.activity` OAuth scope which v1.4.24-and-earlier connections
never requested. This commit ships the scope plumbing + reconnect
surface so existing users can opt in to step / active energy /
distance / floors-climbed ingest with a single click.
- Schema: `WithingsConnection.scope` nullable column. NULL =
legacy connection that's never re-authed since v1.4.25.
- Migration 0050 — additive column add.
- Client: `WITHINGS_OAUTH_SCOPE = "user.metrics,user.activity"`
+ `parseWithingsScope` / `hasActivityScope` helpers.
- Callback: persists `scope: WITHINGS_OAUTH_SCOPE` on every
successful exchange, so reconnecting upgrades the row.
- Status route: exposes `scope` + `hasActivityScope` so the UI
can render the reconnect banner conditionally.
- Settings → Integrations: paint a reconnect banner when the
user has an active connection AND `hasActivityScope === false`.
Click → /api/withings/connect → standard OAuth flow.
- i18n: EN + DE strings for the banner +
`measurements.types.{fatFreeMass,fatMass,muscleMass,
skinTemperature,pulseWaveVelocity,vascularAge,visceralFat}`.
- 5 new unit tests covering the scope helpers.
Note: the Activity sync routine itself
(`POST /v2/measure?action=getactivity`) lands in v1.4.26. Shipping the
scope upgrade now means users only reconnect once instead of twice.
Cross-source dedup protection is already in place via the W5e
foundation (`pickCanonicalSourceRows`): once Activity sync lands AND
a user also has Apple Health passthrough (v1.5), the per-day picker
prevents double-counting cumulative metrics from two sources.
|
||
|
Marc-André Bombeck
|
7846d68dd5 |
feat(insights): sleep-stages chart renders per-night stacked bars (7/14/30d toggle)
Marc directive 2026-05-14 — the /insights/schlaf chart now shows one
bar per night with DEEP / REM / CORE / AWAKE / IN_BED / ASLEEP stacked,
matching Apple Health's sleep tab. The 30-day average-composition
read is preserved as a fallback when the API doesn't yet ship
perNight (legacy clients during rollout).
Plumbing:
- src/app/api/analytics/route.ts: computeSleepStageBreakdown() also
builds a per-Berlin-tz-day perNight array, sorted ascending. Empty
days drop out — the chart treats them as gaps.
- src/components/insights/sleep-stage-stacked-bar.tsx: rewrites
the visualisation. Default window = 7d; 14d + 30d toggles in the
card header (same min-h-11 touch targets as the dashboard range
tabs). Y-axis renders hours, tooltips show per-stage minutes +
percent + nightly total.
- Mobile-first: window-toggle pills reflow under the title on <sm
screens, sit inline on sm+. Bars use Recharts vertical layout
(per the directive — no horizontal reflow on mobile, just tighter
XAxis labels via preserveStartEnd).
i18n: no new keys — reuses insights.sleep.stages.* + the existing
compositionTitle / compositionSubtitle / compositionAriaLabel slots.
Tests: 4 new cases under sleep-stage-stacked-bar.test.tsx cover
- 7d default + three toggle buttons rendering
- empty-state (perNight=[] AND stages={} → 'sleep-stage-empty' slot)
- legacy fallback (no perNight → aggregate row still renders)
- sparse perNight (gaps don't crash the chart)
Existing 4 tests (title + aria + de locale + unknown stage key)
keep passing after perNight prop addition.
|
||
|
Marc-André Bombeck
|
a732b1926e |
feat(withings): subscribe to BP + temperature webhooks alongside weight
setupWebhook now subscribes to appli=1 (weight + composition), appli=2 (temperature), and appli=4 (pressure family: BP, pulse, SpO2) in one pass. The previous implementation only registered appli=1, so a new BP reading from a BPM cuff sat for up to an hour waiting for the hourly poll fallback instead of arriving via push within seconds. A failure on one category is logged and we proceed with the rest — losing one webhook is strictly better than rolling back all three. The disconnect path mirrors the same iteration so cleanup unsubscribes every category we ever subscribed to. Webhook handler already dispatches `syncUserMeasurements` regardless of appli, so no change needed on the receiver side. Exports `WITHINGS_NOTIFY_APPLIS` as the single source of truth so the unit test and the disconnect route stay in lockstep with setupWebhook. |
||
|
Marc-André Bombeck
|
b1a3d59918 |
feat(withings): ingest meastype 123 (VO2 max) into VO2_MAX
The ScanWatch family reports VO2 max under meastype 123 in mL/(kg·min), which matches HealthLog's canonical DB unit verbatim (no conversion needed beyond the standard value × 10^unit exponent decode). Targets the VO2_MAX enum slot added in v1.4.23 for the Apple Health passthrough. |
||
|
Marc-André Bombeck
|
4158a02966 |
feat(withings): ingest meastype 35 (legacy SpO2) into OXYGEN_SATURATION
Older Withings firmware and some partner SDK examples report SpO2 under meastype 35 instead of 54. Mapping both into OXYGEN_SATURATION prevents a quiet drop on legacy devices and is compatible with mixed fleets (the existing meastype 54 path stays in place). |
||
|
Marc-André Bombeck
|
fb23796d72 |
feat(withings): ingest meastype 71 (current-gen Thermo) into BODY_TEMPERATURE
Current-gen Withings Thermo and ScanWatch series report core body temperature under meastype 71 (the legacy meastype 12 stays in place for first-gen Thermo). Both decode through the same value × 10^unit path and target the BODY_TEMPERATURE enum slot. Skin temperature (meastype 73) stays out until v1.4.26 ships a SKIN_TEMPERATURE enum — surface temps (~32 °C) and core temps (~37 °C) must not share a rollup or correlation analytics will collapse. |
||
|
Marc-André Bombeck
|
ae8e2d77aa |
feat(withings): ingest meastype 12 (legacy Thermo temperature) into BODY_TEMPERATURE
First-gen Withings Thermo (WBT01) reports body temperature under meastype 12. The current-gen Thermo ships meastype 71 (next commit). Both decode through the same `value * 10^unit` path the client already applies, and target the `BODY_TEMPERATURE` enum slot we added in v1.4.23 for the Apple Health passthrough. Adds `src/lib/withings/__tests__/client.test.ts` with a synthetic `getmeas` payload covering the exponent decode, unknown-meastype skip, and two-decimal rounding. Re-exports MEASURE_TYPE_MAP so the test can assert the mapping directly without importing internals. |
||
|
Marc-André Bombeck
|
d94981e010 |
chore(withings): document full meastype mapping + API coverage audit
Adds src/lib/withings/mapping.md as the single source of truth for the meastype → MeasurementType table that the client.ts MEASURE_TYPE_MAP mirrors, and .planning/research/withings-api-coverage.md as the full audit of the Withings public API surface (Measure, Sleep, Heart, Activity, Workouts, User, Notify) against HealthLog's ingestion. The audit scores each gap on user-value / effort / schema-impact and slots additions into v1.4.25 (cheap mappings), v1.4.26 (sleep + activity sync, body composition expansion) and v1.5 (ECG, AFib, workouts). |
||
|
Marc-André BombeckandClaude Opus 4.7
|
cd3b890067 |
refactor(v1.4.15): apply simplify-review safe suggestions
Drop dead exports + misleading comments + unreachable defaults flagged by phase-D simplify review (autonomous-yes items only): - channel-state: drop unused TEST_CONSTANTS re-export - retry-policy: drop unused RejectKind type alias - achievements: drop misleading "fallback" comment on exhaustive switch - notification-status-card: drop unreachable default in stateBadgeFor - withings: export isWithingsRefreshReauthFailure + dedupe inline classifier in /api/withings/status route - codex-slug-cache: drop test-only inspectCodexSlugCache helper; tests read getCachedCodexSlug() instead Findings 1, 2, 8, 9 deferred to v1.4.16 (require product call). Finding 11 is an explicit anti-finding. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Marc-André BombeckandClaude Opus 4.7
|
b290a775d0 |
fix(integrations): refresh-token failure marks integration as needing re-auth
v1.4.15 Phase B2, criterion 2. The Phase B2 status helper (commit |
||
|
Marc-André BombeckandMarc-André Bombeck
|
4a6be429ca |
feat(api): test endpoints for Withings, moodLog, Web Push, Glitchtip, Umami (#134)
* feat(api): test endpoints for Withings, moodLog, Web Push, Glitchtip, Umami
Five POST /test endpoints modelled on /api/ai/test (apiHandler +
requireAuth/requireAdmin + checkRateLimit 5/60s + annotate() +
sanitised error mapping):
- /api/integrations/withings/test — pings wbsapi.withings.net /measure
with the decrypted user access token
- /api/integrations/moodlog/test — HEAD against the user's decrypted
moodLog URL (5 s timeout, isPublicUrl
SSRF guard)
- /api/notifications/web-push/test — sends "Push test" via web-push to
every PushSubscription, returns only
endpoint host (never full URL)
- /api/monitoring/glitchtip/test — admin-only; sends a stub event via
sendGlitchtipEvent() using the saved
AppSettings.glitchtipDsn
- /api/monitoring/umami/test — admin-only; HTTPS-only GET against
AppSettings.umamiScriptUrl, checks
body for "umami" marker
Each route has a vitest suite covering: happy path, rate-limit denial,
missing config (422), and upstream-401 sanitisation (no sk-/Bearer/full
URL leak).
Co-authored-by: Marc-André Bombeck <noreply@anthropic.com>
* fix(integration-tests): address review findings — singleton key, redirect SSRF, token refresh, scoped push
Multi-agent review caught a regression set on the five integration test
endpoints. Fixes here address every CRITICAL + HIGH finding:
- AppSettings is keyed on `id: "singleton"` everywhere else; the Glitchtip
and Umami test routes were querying `id: "default"` and would silently
return 422 in production. Tests now assert the where argument so the
typo can't sneak back.
- moodLog and Umami fetch with `redirect: "manual"` to neutralise the
redirect-follow SSRF (a public host could 302 to 169.254.169.254 or
RFC1918 ranges); 3xx is now treated as a configuration error.
- Withings test goes through the existing `getValidToken()` helper, so an
expired access token refreshes the same way the real sync does instead
of reporting "credentials rejected" until the next scheduled sync.
- Glitchtip DSN is validated as HTTPS + public host before any outbound
call, and the dispatch is wrapped in a 5 s `Promise.race` deadline.
- Withings dispatch picks up an `AbortController` 5 s deadline; the
Withings API-level `status` field (HTTP 200 + `status !== 0`) is now
categorised separately from the HTTP status (e.g. `status: 401` →
credentials_rejected, `status: 601` → rate_limited).
- moodLog test does an authenticated GET against the actual sync
endpoint instead of a bare HEAD on the configured URL — a HEAD on the
bare URL would return 200 from a generic landing page even when the
API key was invalid.
- Web Push test sends to the most recent subscription only (was: every
registered subscription, so a user with three devices got three buzzes
per click); tests assert findFirst+orderBy so this can't regress.
- Web Push response shape is the same shape on success and upstream
failure (errors land in the meta envelope, not in the visible
response body) — the prior dead-code in the 401 sanitisation test is
gone.
- Every error response now carries an `errorCode` in `meta` (e.g.
`credentials_rejected`, `rate_limited`, `dsn_host_not_public`) so the
upcoming UI can localise via `t("settings.testConnection.errors." + code)`
instead of rendering the server's English fallback.
- Outbound error annotations strip `Bearer <token>` and full URLs
before they reach Wide Events / Loki — push providers in particular
embed the subscription endpoint (which is the routing secret) in
410/404 error messages.
- Umami response read is capped at 256 KB so a hostile public host
cannot stream gigabytes through us; the marker check is tightened to
tracker shapes (`window.umami`, `umami.track`, `"umami"`) so a 404
page that says "Powered by Umami" no longer false-positives.
- `apiError` now optionally carries a `meta` object so error responses
can include the `errorCode` without breaking the existing
`{ data: null, error: <string> }` envelope.
477 tests green.
---------
Co-authored-by: Marc-André Bombeck <noreply@anthropic.com>
|
||
|
Marc-André BombeckandClaude Opus 4.7
|
98a57eb786 |
audit(v1.3.3): SpO2 + body-composition + 14 CRITICAL/HIGH security/correctness fixes (#121)
* fix(measurements): close issue #109 + sync body composition across UI/PDF/thresholds User-visible: TOTAL_BODY_WATER, BONE_MASS, and BLOOD_GLUCOSE now appear in the measurements filter, badge, mobile icon, and edit dialog (issue #109). Server-rendered doctor report now includes body composition rows (audit C-9). Body water + bone mass have proper effective-range thresholds so severity logic doesn't silently return `nominal` (audit C-15). Structural: extracted the per-type display maps from measurement-list.tsx into measurement-list-meta.ts as a deliberate first step toward the single-source manifest planned for phase P5. Coverage tests now fail-fast if a future enum addition skips any of: list label/icon/color, doctor-PDF label/unit/vital-types, chart label, threshold metric order/label/bounds. Audit-2026-05-07 / phase P0: - closes #109 (filter UI gap, root cause for the German raw-enum display) - closes audit C-9 (server PDF used a stale type map) - closes audit C-15 (no warn/critical bands for body composition) Tests: 282 → 296 (14 new). Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: align OpenAPI spec + migration comment with body-composition reality - OpenAPI MeasurementType enum: add TOTAL_BODY_WATER + BONE_MASS (was at v1.3.0 baseline; spec drifted past the v1.3 server release) - Bump openapi version 1.3.0 → 1.3.2 to match package.json - Migration 0022 comment: TOTAL_BODY_WATER stores kg (water content), not percent of body weight. Validators (VALUE_RANGES) and the Withings client (type 77 → kg) treat it as kg already; the comment was the lone outlier and would mislead the next reviewer. Audit-2026-05-07 / phase P1a — closes audit M-B1 (partial; OpenAPI enum) and M-B2 (migration unit comment). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): close 3 audit CRITICALs (Withings header / idempotency Bearer / GlitchTip URL strip) C-3 (Withings webhook secret in URL): Now reads X-Withings-Webhook-Secret header in preference; URL ?secret=… fallback retained for legacy Withings configurations and emits a Wide Event warning so operators can spot still-using-the-old-flow integrators. The query-string secret was leaking into Coolify access logs and any GlitchTip event whose request.url got captured. C-4 (idempotency dead for Bearer-token clients): The default userIdResolver only consulted getSession(). Bearer-authed clients (the iOS / n8n / headless-API fleet that PR #117 was built for) fell through, so every retry created duplicate measurements. The default now tries cookie session first, then Bearer token via hashToken+apiToken.findUnique with revoked/expiry checks. All three existing call sites (measurements, mood-entries, medications/intake) get the fix automatically. H-B7 (request.url with secrets shipped to GlitchTip): reportToGlitchtip now strips the query string before forwarding the URL, so Withings legacy ?secret=… and any OAuth ?code=… that errors during the callback don't end up in someone else's incident UI. Audit-2026-05-07 / phase P2. Tests: 296 → 301 (5 new in idempotency.test for the Bearer fallback + revoked/expired/null cases). Deferred to a follow-up (needs DB migration / lock primitive): C-2 moodLog webhook → AES-GCM at rest + HMAC-over-body C-5 idempotency TOCTOU advisory_lock or in-flight sentinel row Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(measurements): add OXYGEN_SATURATION (SpO2) as first-class measurement type — v1.3.3 Closes the OxygenSaturation feature request from #109. - Migration 0024 extends MeasurementType enum (additive, IF NOT EXISTS) - Zod validators: plausibility 50–100% (below 50 is incompatible with sustained life; above 100 is physically impossible) - effective-range thresholds: green 95–100, orange 92–94, red <92. Sources: BTS Guideline 2017 (target 94–98%), ATS clinical practice (≥95% at rest is healthy), AHA/clinical literature (<92% = call provider, <88% = ER). Lower-only concern — upper orange wing collapses to greenMax since saturation cannot exceed 100%. - Personalisation: existing thresholds-override UI lets COPD / chronic-respiratory users with a doctor-set 88–92 baseline tune the bands. METRIC_ORDER + METRIC_LABEL_KEYS extended in thresholds-section.tsx; the exhaustive `Record<ThresholdMetric>` forces TS to catch any missed surface. - Withings ScanWatch type 54 mapping (best-effort — only fires for pulse-ox-capable devices). - Wired through measurement-form, measurement-list-meta (icon: Wind), health-chart, both doctor-report-pdf renderers (core + browser-side near-duplicate), OpenAPI spec (version 1.3.0 → 1.3.3), and i18n in 4 sections × 2 locales. - iOS DTO already declared `OXYGEN_SATURATION` — server enum addition closes the long-standing drift flagged in audit V2. - 4 new tests: numeric green band, upper-wing collapse, user-override (COPD baseline), METRIC_BOUNDS shape. Tests: 301 → 305. Typecheck: clean. Audit-2026-05-07 / v1.3.3 / closes #109 SpO2 feature request. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(analytics): truthfulness pass on medical citations + clamp override orangeMax Doctor-agent + hallucination-hunter audit V3 found six medical citations in effective-range.ts that the code did not actually implement. Plus a latent bug in the user-override path that produced physically-impossible orangeMax values (>100% saturation, <0% body-fat). Citation rewrites (no numeric changes): - ACTIVITY_STEPS: "WHO ≥8000 steps/day" → Saint-Maurice JAMA 2020. WHO publishes activity in min/week, not steps. Step-count was a misattribution that also leaked into AI prompts. - TOTAL_BODY_WATER: "ESPEN Body Composition Guidance 2017" → Watson formula / ICRP Reference Man. ESPEN 2017 is BIA practice guidance, it does not publish kg cut-offs. - BONE_MASS: "DEXA-equivalent bone mineral content" → "Bioimpedance- estimated; not DEXA-comparable". Withings BIA values typically run 5–7% below DEXA — calling them DEXA-equivalent in a doctor-report PDF was a real legal-exposure misattribution. - OXYGEN_SATURATION: "BTS Guideline 2017 (target 94–98%) + ATS clinical practice (≥95% at rest is healthy)" → "consumer pulse- oximeter consensus (≥95% normal at rest); slightly tighter than BTS 2017 (94–98%); NICE NG115 ≤92% escalation, BMJ panel / FDA pulse-oximeter labelling ≤88% ER threshold". Code uses 95-100/92-100 band — that's an ATS/consumer-consensus number, not BTS's literal 94-98 target. Soften the citation to match the code, not vice versa. Bug fix (1 latent, 1 real-today): - effective-range override path now clamps orangeMin/orangeMax to METRIC_BOUNDS.{min,max}. Without the clamp, a COPD user setting SpO2 override to {95,100} emitted orangeMax = 100.75 (impossible saturation), and a BODY_FAT override of {2,80} emitted orangeMin = -9.7 (negative percent). Default-range case 210 already hard-coded orangeMax: 100 for the same reason — the override path was the only branch missing the invariant. Tests: 305 → 306 (1 new: clamps override orangeMax to physiological 100%). Typecheck: clean. Audit-2026-05-07-V3 / closes Doctor + Senior-Dev medical-citation findings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): Bearer-scope wildcard handling + GDPR Art.17 account-delete erasure Two CRITICAL fixes from audit V3. NEW-V3-1: Bearer-scope bypass. apiToken.permissions ["*"] is meant to be the wildcard "session-equivalent" scope (the iOS app receives this on login). The previous check permissions.includes(requiredPermission) treated "*" as a literal string — never matched. Today many sensitive routes call requireAuth() *without* a requiredPermission, so a leaked iOS token can act as a full-scope token (account delete, settings wipe). Once those routes adopt requireAuth("scope:name"), this wildcard handling keeps the iOS app working while narrower-scoped tokens (e.g. user-issued ["medication:ingest"]) get correctly 403'd. Same wildcard handling added to the standalone permission checks in src/app/api/ingest/medication/route.ts:65, 119. NEW-V3-2: GDPR Art. 17 account-delete erasure completeness. Feedback + AuditLog rows had `onDelete: SetNull` in the schema, which preserved PII (free-text symptom descriptions, IP addresses, login-city geolocation) after the user was deleted. We now explicitly prisma.feedback.deleteMany + prisma.auditLog.deleteMany before the cascade-delete, making account deletion genuinely complete erasure. Tests 306/306 still pass; typecheck clean. Audit V3. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(pdf): real text-content assertions for body composition + SpO2 rows Replaces bytes-only "renders body composition rows" theatre test with pdf-parse-driven text extraction that asserts the actual rendered labels + values for TOTAL_BODY_WATER, BONE_MASS, OXYGEN_SATURATION (DE + EN). Closes V3 audit finding STILL-V2-NEW-3: the previous test only verified "%PDF-" header + byte-count, so a regression that drops a row would still pass. Now a missing label fails the test. - adds dev dep: pdf-parse@^2.4.5 - 308/308 tests pass (was 306, +2 SpO2 + EN-locale coverage) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(measurements): close enum drift cousins — derive 5 type-arrays from canonical enum + extend 2 contract enums V3 audit finding "enum drift cousins": 7 hardcoded module-level type arrays silently dropped SpO2/TBW/BoneMass/BloodGlucose from their respective domains. Adding a new measurement type required hunting these down. Now all aggregation paths derive from `measurementTypeEnum.options`: - /api/insights/comprehensive (AI insights) - /api/dashboard/summary (iOS dashboard adapter) - /api/analytics (analytics aggregator) - /lib/insights/general-status (AI general-status fetch) - /api/import (Zod schema — round-trip now covers all 11 types) External-contract enums extended additively (no breakage for old clients): - /api/measurements/series kindEnum: + oxygen, totalBodyWater, boneMass - /api/dashboard/widgets widgetIdEnum: + oxygenSaturation - DashboardWidgetId + DEFAULT_DASHBOARD_LAYOUT: + oxygenSaturation row - formatMeasurementsForExport: glucoseContext now round-trips Coverage test (`measurement-type-enum-coverage.test.ts`) asserts the canonical enum stays the source of truth and documents PDF exclusions (BLOOD_GLUCOSE renders via context section, SLEEP/STEPS lifestyle-only). 313/313 tests pass (was 308, +5 new). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): close 6 V3-audit HIGH findings (CSP, web-push SSRF, IP geo, AI provider leak, import rate-limit) - CSP: chatgpt.com + api.openai.com only on /settings/ai/** routes (was blanket connect-src on every page including /auth/login → DOM-XSS exfil channel) - web-push: webPushSubscriptionSchema.endpoint requires HTTPS + isPublicUrl refinement; was z.url() only → blind SSRF probe via Push subscription - isPublicUrl: also fixes a regression where DNS labels starting with "fc"/"fd" (fcm.googleapis.com etc.) were falsely classified as IPv6 unique-local. Check is now gated on a colon being present in the host. - /api/ai/test: stop returning provider err.message + bodyExcerpt to the client (leaked provider URLs / partial keys / internal headers). Now returns categorised generic message; full details land in the wide-event via annotate() for the operator. - /lib/geo (auditLog IP geo lookup): switch default provider to ipwho.is over HTTPS, accept ipwho.is + ip-api pro response shapes, add IP_GEO_LOOKUP_DISABLED env, refuse non-HTTPS configured URLs. Previously leaked IP+timestamp over plaintext HTTP every auth event (GDPR Art. 32 + Art. 44). - /api/import: add 5/hour rate-limit (was unlimited; bulk-injection vector) Tests: 325/325 pass (was 313, +12 new — webPushSubscriptionSchema SSRF guards, fc/fd-prefix domain regression, geo HTTPS-only, geo provider shapes, geo opt-out env). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security,gdpr): trusted-proxy IP, audit-log retention, idempotency cachable filter, Bearer mock tightening V3 audit follow-on bundle covering 4 HIGH findings. (I) getClientIp — TRUST_PROXY_HOPS env (default 1) replaces blind XFF trust. Reads chain right-to-left so client-supplied leftmost entries cannot rotate the per-IP rate-limit bucket. Default 1 matches typical single-proxy self-host (Coolify/Caddy/Cloudflare-Tunnel); 0 forces x-real-ip / null. New 7-test suite covers the rotation attack + malformed entries + zero-hop fallback. (F) Audit-log retention job — daily 03:15 cleanup of audit_logs older than AUDIT_LOG_RETENTION_DAYS (default 365). Closes GDPR Art. 5(1)(e) "storage limitation" gap; previously IPs + city + login events accumulated forever. 6-test suite covers default + override + misconfig guard (rejects <7 days). (G) isCachableStatus — extracted the inline 4xx/5xx filter into a named, exported, tested function. 7 cases cover the full do-not-cache contract (401 / 403 / 408 / 429 / any 5xx) and confirm 2xx + 4xx validation are still cached. (H) Bearer-mock tightening — apiToken.findUnique mocks in require-auth-bearer.test + idempotency.test now assert the where.tokenHash shape uses the hashed value (not the raw bearer). A regression that switched back to raw-token comparison would have been silent without this assertion. Tests: 345/345 pass (was 332, +13 new). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(security): encrypt moodLog webhook secret at rest with AES-256-GCM (V3 audit STILL-V2-C-2) The mood_log_webhook_secret column previously stored a plaintext secret that the webhook handler compared timing-safe against every enabled user. A DB dump or backup snapshot leaked active webhook credentials. New contract — no schema migration required: - Writes go through encryptMoodLogSecret() (AES-256-GCM via existing crypto helper, ENCRYPTION_KEY). - Reads go through readMoodLogSecret() which transparently decrypts envelopes and tolerates legacy plaintext rows during the transition (graceful upgrade path — no breaking change for self-hosted users). - Webhook lookup decrypts each candidate before timing-safe compare. - Status endpoint decrypts for the user's settings page. One-shot startup migration in reminder-worker rotates any leftover plaintext rows on next worker boot. Idempotent; encrypted rows are skipped. Tests: 350/350 pass (was 345, +5 new — round-trip, legacy passthrough, isLegacyPlaintext semantics, rotateLegacy idempotence). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: sync README + AGENTS + CLAUDE + CHANGELOG + OpenAPI for v1.3.3 (V3 audit doc-drift) V3 audit Doku Specialist findings — drift between code and meta-docs. - README §Key Features now mentions pulse oximetry (SpO₂) + Withings ScanWatch sync; Tech Stack model count corrected 23 → 25. - AGENTS.md status promoted v1.3.2 → v1.3.3; vitest config corrected `vitest.config.ts` → `vitest.config.mts`; migration range corrected `0001–0022` → `0001–0024`; model count + list updated to 25 (adds Device, IdempotencyKey). - CLAUDE.md model count updated (2 occurrences). - CHANGELOG.md v1.3.3 expanded with Security + Internal sections that were missing the audit-fix-marathon work (Bearer-scope, account-delete cascade, moodLog encryption, CSP tightening, Web-Push SSRF, IP-geo HTTPS, AI-test leak fix, import rate-limit, trusted-proxy XFF, audit-log retention, idempotency cachable filter, Bearer mock tightening, enum-drift cousins, PDF text-content tests). - OpenAPI Bearer description corrected `SHA-256 hashes` → `HMAC-SHA-256 hashes (keyed with API_TOKEN_HMAC_KEY)` so the docs match the actual server-side implementation. Wildcard scope contract documented. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(audit-review): close 4 HIGH + 2 MEDIUM findings from multi-agent review pass Multi-agent review of the audit-fix branch surfaced four HIGH issues and a couple of MEDIUM hardenings. All addressed before merge. HIGH-1 — OpenAPI MetricKind enum drift (iOS strict-decode crash risk). The dashboard-summary route now emits totalBodyWater/boneMass/ oxygenSaturation MetricCards, but the spec still listed only the original 7 kinds. Generated iOS Codable would have crashed the dash the moment a user logged SpO2. MetricKind extended with the 3 new kinds + comment documenting unknown-value defensive decoding. HIGH-2 — kindEnum naming consistency on /api/measurements/series. The series adapter shipped "oxygen" while the dashboard summary used "oxygenSaturation"; both routes now use "oxygenSaturation" so iOS decoders can share a single MetricKind type across endpoints. HIGH-3 — /api/ai/test no-leak guard had no test. Added 4 tests that mock provider errors with sk-leaked-key + provider URLs in the err fields and assert the response body never echoes them, plus the 3-status-categorised generic messages (401/429/5xx/other). HIGH-4 — /api/import 5/hour rate-limit had no test. Added 2 tests that mock checkRateLimit allowed/disallowed and assert the 429 path uses the right key shape (`import:<userId>`, 5, 1h) and that the within- quota path proceeds. MEDIUM-3 — getClientIp under-length XFF chain regression. With TRUST_PROXY_HOPS=2 and a chain of length 1, the previous clamp returned the leftmost (attacker-controlled) entry, silently re-introducing the rotation attack the helper was meant to close. Now: when chain is shorter than configured hops, refuse XFF entirely (fall back to x-real-ip / null). Added regression test. LOW-1 — TRUST_PROXY_HOPS=garbage now throws at boot instead of silently degrading to hops=0. Added regression test. Tests: 358/358 pass (was 350, +8 new). Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Marc-André Bombeck
|
11ed6faedd |
feat(measurements): add total body water and bone mass types (#89)
- Adds TOTAL_BODY_WATER and BONE_MASS to MeasurementType enum - Migration 0022 (purely additive ALTER TYPE ... ADD VALUE) - Both stored canonically in kilograms (matches Withings hydration/bone mass measures and Health Connect TotalBodyWaterRecord/BoneMassRecord) - Validation, formatters, i18n keys (en + de) for measurement form and doctor-report PDF - Dashboard widgets registered (default-invisible, opt-in via settings) - Withings client maps measure types 77 (hydration) and 88 (bone mass) - Doctor report PDF includes both new types in vital-signs table when data exists |
||
|
Marc-André Bombeck
|
38309932f3 |
Initial release v1.0.0
HealthLog — personal health-tracking PWA with weight, blood pressure, pulse, mood tracking, medication compliance, Withings integration, doctor report PDF export, and Dracula-themed UI. |