tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-09 04:50:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,167 Commits 10 Branches 539 Tags
45fec0fc1be9556d06abe5caed98f83a3a7d16aa
Commit Graph
5167 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marc-André Bombeck 45fec0fc1b feat(02-12.1): refuse a record request whose context has moved 
- both record resolvers check the fence after authentication and before
  the carrier, off the one session row that also decides the scope
- POST /api/account/switch takes an optional expectedEpoch and writes
  conditionally, so concurrent switchers resolve to one outcome
- GET /api/auth/me publishes the context a browser bootstraps from
- every response that resolved a record scope echoes it back
- regenerate the API contract
 2026-08-06 18:21:40 +02:00
Marc-André Bombeck 59359738c8 feat(02-12.1): decide record-session context in one place 
- add an import-free contract module both bundles can name, holding the
  header names, the parse and the verdict
- add the server fence: header read, wide-event stamp, and the refusal
- add RecordSessionChangedError as a third sibling on the existing
  sharing-error arm, so the 409 needs no new serialisation branch
 2026-08-06 17:59:07 +02:00
Marc-André Bombeck 5c9befc0ae feat(02-12.1): stamp a record-context epoch on every session 
- add sessions.record_epoch, owned by a BEFORE UPDATE trigger so the
  ON DELETE SET NULL path and raw SQL writes cannot skip it
- normalise pre-existing rows so epoch zero means never switched
- project the epoch off the row getSession already loads
 2026-08-06 17:52:10 +02:00
Marc-André Bombeck a08e82d0be Merge commit '38214e472' into work/v137-record-session-fence 2026-08-06 17:10:56 +02:00
Marc-André Bombeck 38214e4726 fix(02-12): hold peer tabs during record switches 
- Clear scoped reads before the server session changes
- Reconcile every tab with a fresh access response
 2026-08-06 15:06:12 +02:00
Marc-André Bombeck c66b29d22a fix(02-12): complete profile navigation translations 
- Keep every supported locale aligned with the profile navigation doorway
 2026-08-06 14:37:13 +02:00
Marc-André Bombeck a636a3b4c5 fix(02-12): gate shared record navigation 
- Wait for the shared-record banner before generated reads
- Keep the profile doorway in the navigation translation namespace
 2026-08-06 14:35:02 +02:00
Marc-André Bombeck c42df8cbc3 fix(02-12): gate record preload scope 
- Wait for a validated account scope before warming record reads
- Abort scoped preloads and discard handoffs across record transitions
- Cover malformed scope reloads and fresh own-record recovery
 2026-08-06 14:32:32 +02:00
Marc-André Bombeck 2ea812d387 Merge guardian notification delivery 2026-08-06 14:24:10 +02:00
Marc-André Bombeck 2ae3a66816 fix(02-11): bound APNs provider delivery 
- Time out stalled provider sends without unhandled late rejections\n- Record a transient timeout outcome for cascade fallback\n- Cover timeout fallback with unit and integration tests
 2026-08-06 14:10:28 +02:00
Marc-André Bombeck c56d1ca50b fix(02-11): protect guardian egress data lifecycle 
- Exclude and erase egress claims with recipient-side lookup support\n- Serialize data wipes with managed-profile Guardian authorization\n- Cover last-Guardian and queued-claim wipe races
 2026-08-06 14:05:59 +02:00
Marc-André Bombeck 21e111c06c fix(02-12): refuse malformed record access 
- Preserve absent-server compatibility while rejecting published invalid blocks\n- Partition refused record reads and withhold protected presentation
 2026-08-06 14:03:13 +02:00
Marc-André Bombeck e8ce0e277a test(02-11): verify final claim uses database time 
- Keep a stale application clock from authorizing an expired Guardian\n
 2026-08-06 13:47:42 +02:00
Marc-André Bombeck 4b79f83cf7 fix(02-11): release guardian lock before provider egress 
- Commit a final authorization claim under the lifecycle lock\n- Keep provider calls and retry outcomes outside database transactions\n- Retain authorization claims with notification delivery diagnostics
 2026-08-06 13:46:42 +02:00
Marc-André Bombeck b844d04676 fix(02-12): reject divergent shared-record state 
- Verify the active record matches its canonical switcher entry\n- Skip the owner OCR probe in delegated Labs records
 2026-08-06 13:39:37 +02:00
Marc-André Bombeck 1818bd874b fix(02-11): authorize guardian egress under lock 
- Hold the managed-profile lock through every provider send\n- Add the notification event retention index and race coverage
 2026-08-06 09:42:47 +02:00
Marc-André Bombeck 6ecf0cc8ff style(02-11): format notification attribution test 
- Apply the repository formatter to the existing integration test
 2026-08-06 09:37:42 +02:00
Marc-André Bombeck f5a02c2d29 test(02-11): cover guardian egress races 
- Exercise revocation and expiry against blocked channel egress\n- Require a direct retention index for notification events
 2026-08-06 09:35:43 +02:00
Marc-André Bombeck 358bb39465 fix(02-12): keep scoped record polls dormant 
- suppress whole-record achievements reads for narrowed grants\n- stabilize record journey response assertions
 2026-08-06 08:34:02 +02:00
Marc-André Bombeck e568caa2f1 test(02-12): make record switcher journeys deterministic 
- Address granted records by their published username\n- Start the profile error mock before record navigation
 2026-08-06 08:25:42 +02:00
Marc-André Bombeck c21957db9f fix(02-12): keep record switcher entries reachable 
- Constrain the shared-record submenu to available viewport height\n- Scroll long grant lists without hiding delegated records
 2026-08-06 08:19:43 +02:00
Marc-André Bombeck 60b4845fea feat(02-11): secure guardian notification delivery 
- Remove record-mutating affordances from Guardian channel payloads\n- Reject managed Telegram callbacks and verify channel attribution
 2026-08-06 05:44:41 +02:00
Marc-André Bombeck accb98e223 test(02-11): cover guardian notification channel safety 
- Cover non-interactive Guardian payloads across delivery channels\n- Reject Telegram callbacks tied to managed records
 2026-08-06 05:37:05 +02:00
Marc-André Bombeck 8988cd9e41 chore(02-12): ignore generated Playwright session states 
- Cover all e2e storage-state cookie files\n- Keep generated browser sessions out of version control
 2026-08-06 05:34:16 +02:00
Marc-André Bombeck 123bc15f16 fix(02-12): restore shared banner contrast 
- Use the foreground token for warning context copy\n- Serialize shared-session browser journeys
 2026-08-06 05:34:16 +02:00
Marc-André Bombeck 59de92b62e fix: isolate guardian notification preferences 2026-08-06 05:33:02 +02:00
Marc-André Bombeck be4ee9ac6d test: cover guardian notification preferences 2026-08-06 05:30:49 +02:00
Marc-André Bombeck 4999c786e3 test(02-12): exercise access-level record journeys 
- Seed adult and managed whole-record grants for browser coverage\n- Verify scoped writes, settings boundaries, and refused coach reads
 2026-08-06 05:26:21 +02:00
Marc-André Bombeck a78189b7f6 feat: add guardian notification fanout 2026-08-06 05:23:38 +02:00
Marc-André Bombeck 1c0a5d7777 test: cover guardian notification eligibility 2026-08-06 05:17:56 +02:00
Marc-André Bombeck b231a7892c test(02-12): retire sharing inventory anchors 
- remove obsolete inventory-only journey declarations\n- select persistent shared-record journeys by Playwright project config
 2026-08-06 05:16:32 +02:00
Marc-André Bombeck 9bb1e5b2ea test(02-12): scan shared record accessibility states 
- use an isolated shared-record browser session\n- scan empty, loading, error, and refusal states with axe
 2026-08-06 05:14:00 +02:00
Marc-André Bombeck 5e8b90bcc1 Merge notification delivery identity 2026-08-06 05:12:42 +02:00
Marc-André Bombeck 407f7cc044 test(02-12): exercise scoped record doorways 
- seed isolated records for all eight shared domains\n- verify each browser switch lands on its scoped read surface
 2026-08-06 05:12:33 +02:00
Marc-André Bombeck 7104578d27 fix(02-12): honor shared scope in module pages 
- keep scoped record pages out of actor module redirects\n- suppress unrelated illness reads from document-only records
 2026-08-06 05:12:23 +02:00
Marc-André Bombeck f6b9c8e882 fix(02-12): fail closed in record presentation 
- retain elevated chrome only for internally consistent payloads\n- fall back to the caller record on malformed access entries
 2026-08-06 05:07:27 +02:00
Marc-André Bombeck a33cde3034 test(02-12): cover defensive record presentation 
- reject inconsistent access levels before chrome can elevate them\n- fall back to the caller record for malformed payloads
 2026-08-06 05:06:36 +02:00
Marc-André Bombeck b53147559a feat(02-12): scope cycle startup reads 
- resolve calendar reads against the active record\n- resolve cycle insights against the active record
 2026-08-06 05:05:59 +02:00
Marc-André Bombeck e037c1b8c5 test(02-12): admit scoped cycle startup reads 
- freeze calendar and insights as cycle read handlers\n- retain the exact record resolver scope matrix
 2026-08-06 05:05:13 +02:00
Marc-André Bombeck acd96a80e9 fix(02-12): gate protected routes on record scope 
- resolve account capabilities before protected page queries mount\n- leave public routes outside the record loading gate
 2026-08-06 05:04:26 +02:00
Marc-André Bombeck b358cfa3b8 test(02-12): cover record capability hydration 
- hold protected content until account capabilities resolve\n- keep public routes outside the protected loading gate
 2026-08-06 05:03:22 +02:00
Marc-André Bombeck 6c4dd2d96b feat(02-12): route scoped records to granted domains 
- keep shared navigation independent of actor module preferences\n- open scoped records at their first allowed destination\n- announce record access and kind in doorway names
 2026-08-06 05:02:37 +02:00
Marc-André Bombeck 34073cf8dc test(02-12): cover scoped navigation presentation 
- prove profile uses a read-only shared route\n- cover scoped navigation independent of actor module flags\n- require action, access, and kind in record button names
 2026-08-06 05:00:33 +02:00
Marc-André Bombeck affd356677 test: retain sustained safety event claims 
- exercise the shared notification claim boundary\n- preserve rolling sustained-run dedup coverage
 2026-08-06 04:59:50 +02:00
Marc-André Bombeck 9eab70f032 feat(02-12): add scoped profile summary 
- expose bounded read-only profile facts for shared records\n- keep profile navigation separate from Settings mutations
 2026-08-06 04:59:25 +02:00
Marc-André Bombeck 9ba37342d7 fix: claim notification events atomically 
- serialize rolling event claims before delivery\n- keep provider egress outside the transaction
 2026-08-06 04:57:50 +02:00
Marc-André Bombeck ba7bf49fae test: cover atomic notification event claims 
- race record event claims through PostgreSQL\n- require safety producers to honor the claim
 2026-08-06 04:53:50 +02:00
Marc-André Bombeck e2d308ec31 test: cover read-only profile summary 
- Render bounded profile details\n- Exclude profile mutation controls
 2026-08-06 04:53:28 +02:00
Marc-André Bombeck 60f91d27d7 fix: validate account access payloads 
- Share the closed access schema with OpenAPI\n- Fail closed on malformed or stale record metadata
 2026-08-06 04:52:46 +02:00
Marc-André Bombeck 69f97b268c fix: erase notification anchors with record data 
- remove record event anchors during data deletion\n- retain sustained safety dedup coverage
 2026-08-06 04:48:47 +02:00