tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-09 13:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,381 Commits 11 Branches 539 Tags
4e95bd28f80086e02f183f5541fcac5f04af5d75
Commit Graph
16 Commits
Author SHA1 Message Date
Marc-André Bombeck 5433fc8fbd chore(release): v1.28.26 — internal restructuring for maintainability 
No user-facing change. Eight of the largest source files split along their
natural seams into focused modules, every move verbatim with stable import
paths:

- mood analytics calculators (mood-tag-influence / mood-crosstab /
  mood-better-days / mood-patterns; hub 2229 → 770 lines)
- insight status-invalidation machinery (status-invalidation.ts)
- feature extraction (feature-blocks / signals-of-day)
- doctor report types + pure helpers (doctor-report-types /
  doctor-report-helpers; collector 1756 → 1002)
- Google Health mapping layer (mappers.ts; client 2153 → 1022, acyclic
  client → mappers with type-only back-imports)
- coach chat bubbles + read-aloud controls (chat-bubble / read-aloud;
  message-thread 1713 → 464)
- Telegram webhook handlers to lib (route 1307 → 92 — handler thin, logic in
  lib; rate-limit-before-secret ordering byte-identical)
- coach snapshot cache, series helpers and the four largest per-metric blocks
  (snapshot-cache / snapshot-series / snapshot-blocks; 2691 → 1896)

The glucose-panel-window structural test follows the moved alias; two unused
imports left by the feature split are removed.
 2026-07-11 08:43:41 +02:00
Marc-André Bombeck 336ce5aef3 fix(api): narrow swallowed database errors and redact the incident URL 
The incident forwarder stripped the query string but not path-segment
secrets from the reported URL; route it through the same redaction the
message and stack already use. Several delete-and-swallow paths caught
every error as the expected unique/absent-row case, masking real
failures on security-notification, logout, and integration-disconnect
paths and the Telegram reply-consume guard; narrow each to the specific
Prisma code and let real failures surface.
 2026-07-01 23:45:08 +02:00
Marc-André Bombeck 9c8fb8c7c8 feat(telegram): unique chat binding and numeric measurement capture 
Two related changes to the Telegram bot's data path.

One chat ⇄ one account. `User.telegramChatId` is now UNIQUE (migration
0189, defensive pre-clean of any pre-existing duplicate binding). The
inbound webhook resolves the user from the chat id, so a chat shared
across two accounts would route a reply or button tap ambiguously. The
index is over a nullable column, so an unlinked account (null chat id)
never collides — only two accounts binding the same non-null chat id are
rejected.

Numeric measurement capture. A numeric reply to a measurement reminder is
now captured as a Measurement (`source = TELEGRAM`, added to the enum in
0189). On "Erledigt" for a reminder that names a single-value metric, the
bot offers an optional value prompt via force_reply; a numeric reply is
written through the shared `logTelegramMeasurement` helper — same range
guard, canonical unit, cache + rollup refresh as the manual route. The
reply binds to the reminder and user through a TelegramPromptContext keyed
on the prompt message id (the same strict chat/message binding the
mood-note path uses); the userId is never read from the payload. Comma
decimals are tolerated; non-numeric and out-of-range replies get a calm
hint and write nothing; the reply self-cleans on the ~30-min sweep. Blood
pressure (two values) is out of scope for the single-numeric path and
keeps its satisfy-only flow.
 2026-06-21 21:06:42 +02:00
Marc-André Bombeck b24a893b66 feat(telegram): log mood and act on measurement reminders in chat 
Extend the self-cleaning Telegram bot beyond medication. A mood reminder
now carries a 1-5 inline keyboard plus a "Note..." force-reply and a
"Later" action; a tap logs a MoodEntry (source TELEGRAM, server-side,
user resolved from the linked chat, idempotent on a per-tap externalId)
and confirms with a calm callback toast, no chat echo. An optional
free-text note attaches to that entry via the prompt-context correlation.
A measurement reminder carries "Done" (satisfies the cadence) and
"Later" (pushes nextDueAt forward) — completion and snooze only, no value
capture.

Prompts and replies self-clean in ~30 minutes: the window drops from 1h
and moves to a shared helper, the sender schedules an unanswered prompt's
deletion at send time, and the existing 15-min sweep also prunes expired
prompt-context rows. The webhook keeps the shared-secret + timingSafeEqual
+ rate-limit-before-secret posture; every write callback authenticates via
the stored chat binding. The Telegram chat id is added to the egress
redaction denylist.
 2026-06-21 11:13:33 +02:00
Marc-André Bombeck 1f4ba5939d style: apply prettier across the tree 
One-shot prettier pass so the new format:check gate starts from a clean
baseline. Formatting only — no behaviour change. Generator-owned and
vendored artifacts stay untouched via .prettierignore.
 2026-06-19 22:20:31 +02:00
Marc-André Bombeck 7eeab2ae98 fix(medications): stock claims are atomic and only a dose becoming taken consumes 
Two hardening passes on the consumption stamp:

- consumeForIntake claims the stamp with a single conditional UPDATE
  (NULL-stamp predicate + row lock) instead of read-then-write, so a
  double tap racing a sync replay decrements exactly once; the loser
  sees count 0. restoreForIntake clears the stamp the same way, so
  concurrent restores cannot refund twice.
- Every seam consumes only on the pending-to-taken transition. A sync
  replay that re-posts an already-taken history row, or an edit that
  corrects the timestamp of an old dose, never touches today's stock.
 2026-06-12 18:48:30 +02:00
Marc-André Bombeck 7d3557a3fd fix(medications): every taken dose moves the stock, in units that match the product 
Stock only decremented on the web card's take button — the status
toggle, the phone sync, the Telegram buttons and the token API all
recorded the dose and left the inventory untouched, which is why a
fresh pack kept reading full. Consumption now stamps the intake row
itself: every path that turns a row taken consumes through one module
— open container first, then earliest expiry with auto-open, spilling
into the next pack and flooring at zero — and every path that takes it
back (undo, delete, a take turned skip, a converged duplicate)
refunds exactly what the stamp recorded. Replays and pending sync
echoes can never double-charge, and the nightly convergence pass
refunds the rows it tombstones. A medication can declare units per
dose, so two 2 mg tablets book as one 4 mg dose and stock reads in
doses with the unit count alongside; containers carry a named type
including tablet packs, hold up to a thousand units for inhalers, and
the GLP-1 card reads the same stock as the inventory tab instead of a
separate ledger. The inventory endpoints join the documented API.
 2026-06-12 17:42:31 +02:00
Marc-André Bombeck b4d2d51d46 fix(dashboard,medications): review findings before the cut 
A fresh crisis-level blood-pressure reading outranks an overdue dose in
the daily verdict, and once it ages past a day the dose leads again.
The greeting returns to the page header whenever the daily band is
hidden, and the settings toggle says it rides along. The nightly
convergence pass honours the early grace, so a take recorded shortly
before a window that starts at the dose time heals like the write path
credits it. The early-take context line states a fact — last dose
yesterday, last dose n days ago — instead of claiming an early intake
after a late one, the quick-add default pick runs in the profile
timezone, a dose line without a medication name reads cleanly, the
early-grace constant has one home, and the Telegram confirm writes
intake and snooze atomically again.
 2026-06-12 11:22:21 +02:00
Marc-André Bombeck aaecd141ee fix(medications): every intake path converges on the slot, and caches cannot resurrect a pre-write body 
The external ingest endpoint was the one intake writer that never
attributed to the minted band: it stored a bare row beside the pending
slot, so an early take through the API showed as the last intake while
the slot kept demanding a dose, the ledger recorded an extra plus a
miss, and the day tally counted both. It now resolves the band and
converges onto the pending row like every other path, the Telegram
confirm and skip buttons do the same preferring the reminder's own
slot, and the nightly convergence pass heals the pairs this has
already produced — one band match, one live anchor row, both days'
rollups recomputed. The cache layer fences in-flight builders on
invalidation so a read can neither join a pre-write build nor have a
background refresh re-cache a pre-write body as fresh. Ad-hoc rows no
longer resolve a different slot through the six-hour radius, a bounded
early grace credits a take up to an hour before the window without
crossing the previous band, day-scale cadences taken early downgrade
the slot-day prompt instead of inviting a double dose, the overdue
pill ignores the projector's pending mints, created intakes carry the
same plausibility bounds as edits, slot moves keep the recorded
injection site and dose, both affected days recompute on a moved
toggle, deliberate slot-less skips converge instead of orphaning, the
coach reads adherence from the ledger, the cards and quick-add run in
the user's timezone with the served next-due as the gate, and
schedule-revision, wipe and restore writes invalidate the caches they
feed.
 2026-06-12 10:43:32 +02:00
Marc-André Bombeck 65677c2112 fix(api): bound every JSON body read 
Raising the middleware body cap to 512 MB for archive imports removed
the implicit ceiling that protected JSON routes, so any bulk endpoint
would buffer an arbitrarily large body before validation ran. Every
JSON body read under /api now carries an explicit byte cap sized to its
legitimate payload (64 KB for single-record routes up to 16 MB for the
measurement import), webhooks cap before signature work, and oversized
bodies return 413.
 2026-06-10 11:36:51 +02:00
Marc-André Bombeck 1114cf7e63 chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement 
Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.
 2026-05-21 12:48:02 +02:00
Marc-André Bombeck d84922cdc3 chore(release): v1.4.39 — mood, medication-compliance, and cumulative-sum rollup tiers 
Squashed merge of the v1.4.39 wave work from develop. The release
extends the v1.4.38 fast-path posture to two more endpoints that
still walked the source table on every cold mount and folds a
cumulative `sum_value` column into the existing rollup tier so step /
flight / distance / daylight / active-energy sparklines no longer
re-derive their daily totals in Node.

Raw measurements / mood_entries / medication_intake_events tables are
byte-unchanged. Three new tiers (mood_entry_rollups,
medication_compliance_rollups, measurement_rollups.sum_value) are
derived caches that self-heal via boot-time backfill on first reach.

Migrations 0070, 0071, 0072 are additive only. The sum_value column
add is catalog-only DDL on PostgreSQL 11+ — no table rewrite, writes
resume in milliseconds. No environment-variable change. No API
contract break. No iOS contract change.

Expected wins (live perf-verify rides the post-deploy window):
- /api/mood/analytics cold 12.7 s -> ~200 ms
- /api/medications/intake?scope=compliance cold 3.2 s -> ~200 ms
- /api/dashboard/summary cumulative sparkline ~500 ms -> ~300 ms
- /api/analytics live-fallback row cap 347 k -> ~5 k (425 d cap
  preserves the year-ago baseline tile)

Tests 4 524 -> 4 640 (+116). Typecheck clean. Lint clean.

See CHANGELOG.md for the full v1.4.39 entry.
 2026-05-21 07:39:10 +02:00
Marc-André BombeckandClaude Opus 4.7 02b99553b9 chore(style): repo-wide prettier sweep before v1.4.6 tag 
Long-overdue prettier sweep; prettier had drifted vs. checked-in code
across ~130 files (mostly long-argument line-break wrapping in TS and
table-padding in markdown). Pure formatting — no semantic changes —
and required to clear the v1.4.6 release gate's `pnpm format:check`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-09 02:27:17 +02:00
Marc-André Bombeck 6e74612efc test(coverage): real-behaviour tests for audit + webhook routes (~80% line coverage) (#142) 
Adds vitest unit tests covering the four zero-coverage webhook /
monitoring surfaces external systems hit. Each test mocks at the module
boundary (per existing project pattern in src/app/api/auth/login/
__tests__/native-token.test.ts) and asserts on actual call arguments
— no test theatre.

Per-file line coverage:
- src/lib/auth/audit.ts                                    100.00%
- src/app/api/withings/webhook/route.ts                     98.11%
- src/app/api/integrations/moodlog/webhook/route.ts         95.23%
- src/app/api/telegram/webhook/route.ts                     95.12%

Test count: +61 (494 -> 555).
 2026-05-08 14:30:03 +02:00
Marc-André BombeckClaude Opus 4.7dependabot[bot]Marc-André Bombeck
 		8533755d8d release(v1.2): i18n, thresholds, glucose, dashboard customization, feedback, multi-provider AI (#77) 
* fix(i18n,ux): package A — missing keys, chart labels, query invalidation, admin error UX

Addresses bugs surfaced in issues #73 and #74 plus drift found during audit.

- i18n: add 21 missing translation keys (targets.* namespace was only
  partially populated after the English-first migration; common.reset and
  settings.configured were referenced but absent), plus common helpers
  (copy, copyDetails, retry, reportIssue) and admin.settingsSaveError.
- charts: rename points7Label/30Label/90Label from cryptic "7P/30P/90P"
  to "7 pts / 30 pts / 90 pts" in EN and "7 Pkt / 30 Pkt / 90 Pkt" in DE.
- queries: add src/lib/query-keys.ts as a single source of truth with
  measurement/mood/medication-dependent key sets. Wire them into
  measurement-form/list, mood-form/list, medication-form/card,
  intake-history-list, intake-timeline, medications page, and Withings
  sync in settings. Fixes dashboard not auto-refreshing after adding a
  measurement (old code only invalidated ["measurements"], not
  ["analytics"] / ["insights"] / ["insights","targets"]).
- admin: useUpdateSettings + updateUser mutations now surface real error
  messages via sonner toasts and invoke getApiErrorMessage() so saves
  fail loudly instead of silently. Success also gets a toast.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(i18n): package B — locale-aware formatters throughout

Removes the hard-coded de-DE locale that lingered from the German-first era
and makes every number, date, and time locale-aware. English stays the
default per user preference; German remains selectable.

New:
- src/lib/format-locale.ts exposes makeFormatters(locale) + a cached
  Europe/Berlin timezone. Covers number, integer, percent, date, dateShort,
  dateTime, time, dateWithWeekday, monthShort. Also exports
  parseLocaleFromAcceptLanguage() for server code.
- useFormatters() hook in @/lib/i18n/context resolves from the active
  locale, memoized per render.

Migrated (all Intl.NumberFormat("de-DE") / toLocaleString("de-DE") /
Intl.DateTimeFormat("de-DE") call sites):
- src/app/page.tsx (dashboard)
- src/app/insights/page.tsx
- src/app/admin/page.tsx
- src/app/settings/page.tsx (Withings last-sync, doctor-report caller)
- src/components/charts/trend-card.tsx (+ i18n "7d"/"30d" short labels)
- src/components/charts/health-chart.tsx
- src/components/medications/medication-card.tsx
- src/components/medications/medication-form.tsx
- src/components/measurements/measurement-list.tsx
- src/components/mood/mood-list.tsx
- src/components/insights/insight-status-card.tsx (also removed 5 German
  hard-coded strings with TODO: i18n markers — now translated)
- src/components/insights/insight-advisor-card.tsx (same — 10+ strings)

Server: reminder-check / reminder-worker / umami-test switched from
"de-DE" to neutral en-GB/en-US where the string is machine-compared rather
than user-facing. Bug-report GitHub issue titles use ISO-8601 UTC now —
the repo is English-speaking.

Next.js metadata:
- OpenGraph locale from "de_DE" → "en_US" with "de_DE" as
  alternateLocale.
- Root layout now reads healthlog-locale cookie (falls back to
  Accept-Language) and sets <html lang> server-side, avoiding an
  EN-flashes-then-DE hydration gap and fixing SEO/a11y.
- I18nProvider mirrors locale to a 1-year SameSite=Lax cookie so the next
  SSR pass is correct.

Doctor-report PDF:
- generateDoctorReportPDF(data, { t, locale }) now accepts injected
  translator + locale. All section titles, column headers, BMI / BP
  classifications, mood labels, and the footer disclaimer are
  i18n-driven. File name slug switches between gesundheitsbericht / health-report.
- 40+ new doctorReport.* keys in EN + DE.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ux): package C — typed passkey errors, bug-report gating, error boundary

Addresses issue #73 points 1, 5, 6 and lays groundwork for copy-paste
error reporting requested during review.

Passkey registration / login (#73.1):
- src/lib/passkey-errors.ts maps DOMException.name + SimpleWebAuthn code
  to specific i18n keys instead of swallowing every failure as
  "cancelled". Distinguishes NotAllowed/InvalidState/NotSupported/
  Security/Abort errors and falls back to a diagnostic message.
- settings passkey + login passkey flows both use describePasskeyError
  now, so origin mismatches and previous-registration collisions show
  actionable copy.
- 5 new passkey.* i18n keys in EN + DE.

Bug report (#73.5):
- New GET /api/bugreport/status reports {configured, hasToken, hasRepo,
  isAdmin}.
- /bugreport page now queries status first. When not configured it shows
  a notice (different copy for admins vs. regular users) with a direct
  link to the admin panel. Form is hidden, not silently broken.
- When POST /api/bugreport can't create issues it returns 503 instead
  of 500 with the same user-facing message.
- 4 new bugreport.* i18n keys.

Global error UX:
- src/components/error-details.tsx — reusable panel with retry + copy
  diagnostics (message, digest, stack (trimmed), URL, user-agent,
  request-id, locale, timestamp) + report-issue link. Clipboard fallback
  prompt covers insecure-context cases.
- src/app/error.tsx uses it.
- src/app/global-error.tsx is provider-free (no i18n dependency) since
  it replaces the root layout on catastrophic failures — hardcoded
  English + Dracula palette so it still looks like HealthLog.
- 2 new errorBoundary.* keys and 4 common.* keys (copy, copyDetails,
  retry, reportIssue).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(query-keys): collapse repeated invalidation blocks into invalidateKeys helper

Eleven mutation handlers repeated `Promise.all(keys.map(k => invalidate({queryKey: k})))`
verbatim. Adds `invalidateKeys(qc, keys)` to the existing query-keys factory and
adopts it everywhere, including replacing the local `invalidateMedicationRelated`
helper that medication-form.tsx had grown. Also fixes the import-sandwich that
helper introduced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: small simplifications in i18n/UX changes

- passkey-errors: drop the typeof-name dance now that error.name is already string after the instanceof Error narrow
- doctor-report-pdf: replace nested gender ternary with a small lookup map; clarify unitFor's null-as-translation-marker convention
- dashboard page: route the analytics queries through the new queryKeys factory so future invalidation stays in one place
- health-chart: add missing fmt dependency to trendInfo useMemo (introduced when formatSigned was switched to the locale-aware formatter)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ai): capture upstream response body in OpenAI errors

A production insights burst at 12:19 UTC failed with "OpenAI request
failed (500)". The 500 was the upstream OpenAI HTTP status (confirmed
via logs), but we had no way to tell from logs whether it was an
OpenAI incident, a model-not-found, or a response_format rejection
because the response body was thrown away.

Now the error message includes the first 500 chars of the response body
and structured fields (httpStatus, upstream, model) that Wide Event
logging can attach. No behavior change for the happy path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(review): address code-review + security findings

Review round produced five real issues — fix them all, plus three nits
that were cheap enough to bundle.

Must-fix:
- security: error-details.tsx + global-error.tsx were copying
  window.location.href into the clipboard, which on OAuth callback
  routes (/api/withings/*, password reset) would leak code/state
  tokens into GitHub issues. Strip to pathname + searchParamCount.
- fe: query-keys.invalidateKeys now uses Promise.allSettled, so a
  transient invalidate failure doesn't abort the chain and no
  unhandled rejection leaks from void invalidateKeys(...) call sites.
- fe: resolveInitialLocale in app/layout.tsx wraps cookies()/headers()
  in try/catch — a dynamic-server error in the root layout now
  degrades to the "en" default instead of crashing into global-error.
- be: reminder-worker + reminder-check parseTimeToMinutes normalize
  "24:00" → "00:00" (some ICU builds emit that for midnight under
  en-GB). Prevents a 1440-minute comparison against schedule windows.
- security: openai-client error body excerpt redacts sk-* / Bearer
  tokens before logging, and moves the excerpt off Error.message into
  a structured field (bodyExcerpt) so log transports can filter it.
- i18n: /api/withings/connect German error message → English.
- i18n: /insights/page.tsx hardcoded "Fehler beim Laden" → t(...)

Hardening:
- /api/bugreport/status collapses to {configured, isAdmin} and adds
  a 30/min rate limit per user. Client interface updated.
- i18n/context.tsx: I18nProvider's initializer now reads the cookie
  (matches SSR) before falling back to localStorage or browser
  detection — eliminates the locale-flash hydration class.
- format.ts legacy helpers also read cookie first, matching SSR.

Tests:
- new src/lib/__tests__/format-locale.test.ts — 9 cases covering
  makeFormatters, parseLocaleFromAcceptLanguage, resolveIntlLocale
- new passkey-errors.test.ts — 8 cases covering every DOMException
  name and SimpleWebAuthn code we map
- new query-keys.test.ts — bundles + invalidateKeys allSettled
  semantics (incl. partial-failure test)

118 → 142 tests. All pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(v1.2): thresholds, glucose, dashboard customization, built-in feedback, multi-provider AI (#76)

* build(deps): bump @prisma/adapter-pg from 7.6.0 to 7.7.0 (#60)

Bumps [@prisma/adapter-pg](https://github.com/prisma/prisma/tree/HEAD/packages/adapter-pg) from 7.6.0 to 7.7.0.
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.7.0/packages/adapter-pg)

---
updated-dependencies:
- dependency-name: "@prisma/adapter-pg"
  dependency-version: 7.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump prisma from 7.6.0 to 7.7.0 (#61)

Bumps [prisma](https://github.com/prisma/prisma/tree/HEAD/packages/cli) from 7.6.0 to 7.7.0.
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.7.0/packages/cli)

---
updated-dependencies:
- dependency-name: prisma
  dependency-version: 7.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump eslint-config-next from 16.2.2 to 16.2.3 (#62)

Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.2.2 to 16.2.3.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.3/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump next from 16.2.2 to 16.2.3 (#65)

Bumps [next](https://github.com/vercel/next.js) from 16.2.2 to 16.2.3.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.2...v16.2.3)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump @types/node from 25.5.2 to 25.6.0 (#66)

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.5.2 to 25.6.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump dotenv from 17.4.0 to 17.4.1 (#67)

Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.4.0 to 17.4.1.
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](https://github.com/motdotla/dotenv/compare/v17.4.0...v17.4.1)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 17.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump @tanstack/react-query from 5.96.2 to 5.99.0 (#70)

Bumps [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) from 5.96.2 to 5.99.0.
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.99.0/packages/react-query)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.99.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump typescript from 5.9.3 to 6.0.2 (#64)

Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 6.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.2)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump prettier from 3.8.1 to 3.8.2 (#68)

Bumps [prettier](https://github.com/prettier/prettier) from 3.8.1 to 3.8.2.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.1...3.8.2)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.8.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump react from 19.2.4 to 19.2.5 (#63)

Bumps [react](https://github.com/facebook/react/tree/HEAD/packages/react) from 19.2.4 to 19.2.5.
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump vitest from 4.1.2 to 4.1.4 (#69)

Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.2 to 4.1.4.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.4/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump @prisma/client from 7.6.0 to 7.7.0 (#71)

Bumps [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) from 7.6.0 to 7.7.0.
- [Release notes](https://github.com/prisma/prisma/releases)
- [Commits](https://github.com/prisma/prisma/commits/7.7.0/packages/client)

---
updated-dependencies:
- dependency-name: "@prisma/client"
  dependency-version: 7.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump shadcn from 4.1.2 to 4.2.0 (#72)

Bumps [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) from 4.1.2 to 4.2.0.
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.2.0/packages/shadcn)

---
updated-dependencies:
- dependency-name: shadcn
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(thresholds): foundation + settings UI (v1.2)

Introduces per-user health threshold overrides with an auto-default /
user-override pattern. Default computation stays evidence-based (WHO,
ESC/ESH 2018, AHA, AASM, ADA 2024, DGIM/DDG S3). Overrides live in
User.thresholdsJson; any missing metric falls through to the default so
new users need zero configuration.

Schema (migration 0021):
- New enums: glucose_context (FASTING/POSTPRANDIAL/RANDOM/BEDTIME),
  feedback_category, feedback_status.
- measurement_type gains BLOOD_GLUCOSE; Measurement gets optional
  glucose_context (enforced via CHECK constraint — only set for glucose).
- User gains thresholds_json, dashboard_widgets_json, glucose_unit,
  ai_provider, ai_model, ai_base_url, ai_anthropic_key_encrypted,
  ai_local_key_encrypted (stubs for the upcoming features).
- New Feedback table for the built-in feedback system (next commit).

Backend:
- src/lib/analytics/effective-range.ts is the single source of truth:
  getEffectiveRange(metric, profile, overrides) returns the resolved range
  + the pristine default + physiological bounds. Every chart, band,
  insight prompt, and doctor-report section should call this.
- Supports 11 metrics incl. four glucose contexts with ADA/DGIM ranges.
- src/lib/validations/thresholds.ts — Zod schema with per-metric bounds
  and min<max refinement.
- GET/PUT/DELETE /api/user/thresholds with full audit logging (before/
  after) so medical-ish data mutations are traceable.

UI:
- src/components/settings/thresholds-section.tsx — clean per-metric row
  with Auto/Override Switch, inline min/max, reset-per-row + reset-all,
  and a "this looks outside guideline ranges" warning banner that only
  shows when the override is >30% off the default.
- New Personalization section in /settings.
- 25 new i18n keys (EN + DE) in a `thresholds.*` namespace.

Tests: 8 new cases covering default computation, override application,
missing profile gracefully returning null, glucose-context defaults, and
per-metric bounds. 150/150 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(glucose): wire BLOOD_GLUCOSE + context through the write path

Extends measurement validation and the POST /api/measurements route to
accept blood-glucose samples with a required `glucoseContext`
(FASTING / POSTPRANDIAL / RANDOM / BEDTIME).

- Zod schema adds BLOOD_GLUCOSE to the type enum and glucoseContextEnum.
- refine(): BLOOD_GLUCOSE requires a context; every other type must not
  set one — mirrored by the Postgres CHECK constraint from migration 0021
  so callers bypassing validation still can't write inconsistent rows.
- VALUE_RANGES gains BLOOD_GLUCOSE (20-800 mg/dL) — covers severe hypo
  through severe hyperglycemia.
- getUnitForType(BLOOD_GLUCOSE) returns "mg/dL" (canonical storage).
  Display in mmol/L is a UI-level conversion per user preference.
- Error messages translated to English (removed two lingering German
  refine messages while here).

Measurement form + charts + targets UI follow in the next commits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(i18n): localize AI insight prompts (en/de)

Each prompt builder (base-system, blood-pressure, bmi, general-status,
medication-compliance, mood, pulse, weight) now accepts a Locale and
returns the system + user prompt either fully in English or fully in
German. Stable contract keys (classification enum optimal/gut/grenzwertig
/erhoht/kritisch, confidence niedrig/mittel/hoch) are preserved verbatim
so the response parser keeps working — only the natural-language sections
are translated. The prompt explicitly tells the model to emit
classificationLabel / summary / recommendations in the user's language.

Wires the locale through every status generator (general / blood-pressure
/ bmi / weight / pulse / mood / medication-compliance) into the prompt
calls and adds a small server-side resolver
(src/lib/i18n/server-locale.ts: explicit override > healthlog-locale or
userLocale cookie > User.locale > Accept-Language header > default
English) used by all /api/insights/*-status routes plus
/api/insights/generate. The auditLog cache key already contains the
locale suffix, so cached entries stay disjoint per language.

The reminder worker continues to fall back to "de" when User.locale is
null, matching its prior behaviour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(glucose): UI + unit conversion helpers

- src/lib/glucose.ts — mg/dL ↔ mmol/L conversion (factor 18.0182 per
  DGIM/DDG), resolveGlucoseUnit() defaulting to mg/dL,
  thresholdMetricForContext() mapping each context to the matching
  effective-range key.
- Measurement form gains a "Blood glucose" option (mg/dL) with a
  context selector (fasting / postprandial / random / bedtime). The
  glucoseContext field is only sent for BLOOD_GLUCOSE — the Zod
  refinement and the Postgres CHECK constraint both enforce that.
- 10 new i18n keys per locale (measurements.typeBloodGlucose,
  glucoseContext*, glucoseUnit, glucoseUnitHint).
- 6 new tests covering conversion roundtrip, unit resolution defaults,
  and context → threshold-metric mapping.

Charts, target cards, and doctor-PDF row for glucose follow in the
next commits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(feedback): built-in feedback system (no GitHub required)

Implements the feedback-system design from the v1.2 spec. The submit
button on /bugreport now always works — even when no admin has
configured a GitHub repository. Feedback is stored in the Feedback
table (migration 0021) with an admin inbox for triage.

Endpoints:
- POST /api/feedback — user submits. Auth-gated, rate-limited 5/hour.
  Category (BUG / FEATURE_REQUEST / QUESTION / OTHER), subject,
  description, optional screenshot (≤5 MB, base64), optional metadata
  (locale, URL path, userAgent).
- GET /api/feedback — user's own history (paginated).
- GET /api/admin/feedback — admin inbox with status filter and
  counts-by-status for tab badges.
- PATCH /api/admin/feedback/[id] — update status / admin note.
- DELETE /api/admin/feedback/[id] — soft-archive.

Every mutation writes to AuditLog with before/after details.

UI:
- /bugreport rewritten: category dropdown, optional subject, always
  submits. Informational banner explains whether the server has GitHub
  escalation available or keeps feedback internal-only.
- Legacy "not configured" blocker is gone — the form is never hidden.
- 8 new bugreport.* i18n keys per locale.

The old POST /api/bugreport route and /api/bugreport/status endpoint
are left intact for backwards compatibility; they'll be removed in
v1.3 once no one depends on them.

Admin inbox UI lands in the next commit alongside the dashboard and
multi-provider work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(telegram): localize bot UI per User.locale

The Telegram webhook now resolves the user's locale (User.locale, falling
back to "de" so existing bots stay German) and runs every reply, inline-
keyboard label and callback toast through a small server-side translator.

Adds src/lib/i18n/server-translator.ts (getServerTranslator) — reads the
same messages/{en,de}.json bundles the client uses, with the same
"missing key falls back to English, then to the raw key" semantics, and
the same {param} interpolation. Importing the client useTranslations()
hook into a server route would have pulled React in, so this mirrors
just the parts the bot needs.

Adds the telegram.* namespace to messages/en.json and messages/de.json
covering: button labels, callback toasts, the /help body, /add prompt,
medication-not-found / inactive errors, snooze/skip/confirm confirmations
and the cancel button. The "genommen" / "taken" intake keyword and the
"hi/hallo/hey/moin/hello" greeting list are accepted regardless of UI
locale to keep backwards compatibility for existing users.

Also adds 6 vitest cases for getServerTranslator (basic resolution,
locale switching, parameter interpolation, English fallback, raw-key
fallback, exposed locale).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(dashboard): user-customizable widget layout

Implements the dashboard customization spec: users choose which widgets
appear on / and in what order. Auto-default keeps the current v1.1
behavior so nothing changes without opt-in.

Backend:
- src/lib/dashboard-layout.ts — single source of truth with
  DEFAULT_DASHBOARD_LAYOUT (10 widgets incl. the new sleep/steps/glucose
  ones that were previously hard-conditional), a version field for
  future schema evolution, and resolveDashboardLayout() that merges
  persisted state with defaults so new widgets auto-appear (invisible
  by default) when the schema bumps.
- GET / PUT / DELETE /api/dashboard/widgets with strict Zod validation
  (version literal, widget-id enum, order range).
- Persisted in User.dashboardWidgetsJson (column added in 0021).

UI:
- src/components/settings/dashboard-layout-section.tsx — mounted under
  the new Personalization section alongside Thresholds. Local edit
  buffer so toggling/reordering doesn't fire a network call per click;
  single "Save" commits. Each widget has Up/Down buttons + visibility
  toggle, plus a reset-to-defaults button at the section header.
- 11 new dashboard.* i18n keys per locale.

Dashboard page integration is staged — widgets currently still render
per the old data-conditional rules. Wiring the saved layout through
/app/page.tsx is a follow-up so this commit stays focused on the
plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(auth): locale-aware password-strength feedback

Completes the zxcvbn i18n migration by wiring the new
getZxcvbnTranslations(locale) helper into the client PasswordStrength
component and removing the obsolete zxcvbn-de helper.

- src/components/ui/password-strength.tsx reads the active locale from
  useTranslations() and memoizes the translator per locale — so
  changing language instantly retranslates open warnings/suggestions.
- src/lib/zxcvbn-de.ts deleted. Every consumer now routes through
  zxcvbn-i18n.ts which carries both EN and DE mappings.
- server-side checkPasswordStrength (already refactored earlier in this
  session) continues to accept locale; clients can pass it from the
  session.

No test impact — 162 pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dashboard): replace setState-in-effect with draft-overlay pattern

The dashboard-layout-section.tsx initial implementation synced server
state into local state via useEffect, which trips the project's strict
react-hooks/set-state-in-effect rule. Rewrote using a nullable draft
pattern: `layout` is derived as `draft ?? remote`, and only user edits
set the draft. Save/Reset clear the draft so the server copy wins
again. Cancel also clears instead of re-seeding from server.

No behavior change, no new tests — the component contract stays the
same. Lint back to baseline (2 errors / 7 warnings, both pre-existing).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: v1.2 README + CHANGELOG (thresholds, glucose, dashboard, feedback, multi-provider AI)

- CHANGELOG 1.2.0 entry covering 5 new features + locale polish
- README Key Features expanded: glucose, custom thresholds, dashboard
  customization, multi-provider AI, built-in feedback
- Doctor Report description updated for locale-aware output

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(targets): glucose cards per context with effective range + unit conversion

Render one target card per logged glucose context (FASTING, POSTPRANDIAL,
RANDOM, BEDTIME) on /targets, sourcing the threshold band from
getEffectiveRange() so user overrides apply consistently. The targets API
returns glucose values canonical mg/dL; the page converts to the user's
glucoseUnit preference via convertGlucose() before display.

- Extend /api/insights/targets to include per-context glucose summaries
  (latest, 30-day average, range, classification) and surface glucoseUnit
  in the profile envelope.
- Expose glucoseUnit on /api/auth/me and AuthUser type.
- Targets page resolves the i18n label key, applies unit conversion to
  current/avg/range, and uses Droplet iconography.
- Add targets.glucoseFasting/Postprandial/Random/Bedtime keys to en + de.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): address H1 (CSP nonce), H3 (SSRF), M1+M2 (XSS)

From the v1.2 full-repo security audit:

- **H1 / CWE-79** src/proxy.ts: CSP nonce was base64 of the UUID *string*
  form, which gives ~122 bits and a structured pattern (hyphens at fixed
  offsets). Replaced with 16 random bytes → proper 128-bit nonce.
- **H3 / CWE-918** src/app/api/admin/ai-settings/route.ts: the admin AI
  base URL only required "https://". A compromised admin cookie could
  point it at attacker.example and exfiltrate the bearer key on the
  next insight call. Now validates with URL parser, requires https://,
  and only accepts hosts on a small allowlist (OpenAI, Anthropic,
  Google AI, Mistral, Groq, OpenRouter). Ops can extend via
  `ADMIN_AI_BASE_URL_ALLOWLIST` env var.
- **M1 / CWE-79 (stored, off-platform)** src/app/api/bugreport/route.ts:
  bug-report description flowed to GitHub with only backtick/asterisk
  stripping. Now strips HTML tags entirely, neutralises dangerous
  markdown link schemes (javascript:/data:/vbscript:/file:), and wraps
  the whole body in a fenced code block so residual markdown renders
  literally.
- **M2 / CWE-79** Zod schemas for feedback + bugreport screenshot now
  require a base64 PNG/JPEG/WEBP/GIF data URL via regex. SVG
  deliberately excluded — it can carry inline JS that would execute
  when the admin inbox renders the `<img>` preview.

Medium rate-limiter semantics (audit M3) left as-is: the fixed-window
behaviour is acceptable for a single-tenant PWA and matches what ops
actually want. Remaining M4–M6 + L1–L7 are tracked for v1.3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(dashboard): glucose TrendCards + chart label support

Render one TrendCard per logged glucose context on the dashboard when
the user has the "glucose" widget enabled in their layout. Cards
respect the user's glucoseUnit preference via convertGlucose(); data
sources from the existing /api/analytics endpoint, which now emits a
glucoseByContext map alongside the summaries object.

- /api/analytics: include BLOOD_GLUCOSE in the type whitelist (so
  total counts include glucose) and add glucoseByContext containing a
  summarize() result per context.
- HealthChart: wire BLOOD_GLUCOSE into BASE_TYPE_LABEL_KEYS so the
  legend shows the localized "Blood glucose" label when the chart is
  invoked for that type.
- Dashboard page: fetch the dashboard layout, gate glucose cards on
  widget visibility AND data presence, render Droplet-icon TrendCards.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(i18n): bugreport.subtitle no longer promises a GitHub issue

The visual QA pass flagged that bugreport.subtitle still said "a
GitHub issue will be created automatically" even though the banner
below the heading correctly explains the submission is stored locally
(built-in feedback system, GitHub is only an optional escalation).
Neutral copy now that matches the actual behaviour in both locales.

* feat(ai): user-level provider selection + test endpoint + UI

Adds the missing pieces for the multi-provider AI MVP that pair with
the AnthropicClient and LocalOpenAICompatibleClient already on disk:

* /api/user/ai-provider (GET + PATCH): user can pick OPENAI /
  ANTHROPIC / LOCAL / CHATGPT_OAUTH and store provider, model, baseUrl
  and per-provider API keys. Anthropic + local keys go through the
  existing AES-256-GCM crypto helper. Provider value is whitelisted.

* /api/ai/test (POST): rate-limited (5/min/user) round-trip that
  resolves the user's provider and asks for a tiny JSON ack so the UI
  surfaces real "does this config work?" feedback instead of a blind
  Save.

* settings/page.tsx: appends a per-user override card under the
  existing AI Insights section. Provider dropdown drives conditional
  fields (Anthropic key for ANTHROPIC, baseUrl + optional bearer for
  LOCAL, model for all), then Save / Test buttons.

* provider.test.ts: extended to cover the four new cases (ANTHROPIC
  with key, ANTHROPIC fallback, LOCAL, OPENAI routes through admin
  key, CHATGPT_OAUTH routes through Codex). Switched to
  resetAllMocks() in beforeEach to flush mockResolvedValueOnce queues
  between cases — the prior clearAllMocks() leaked them.

* local-client.test.ts: full happy / no-auth / bearer-auth / structured
  error / empty-content coverage mirroring the openai-client suite.

typecheck + tests green; lint stays at the pre-existing 2 errors / 7
warnings baseline (no new findings introduced).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: integrate late agent additions (glucose PDF row + i18n)

* test(glucose): cover display-unit conversion edge cases

Lock in the precision contract for the targets/dashboard/PDF surfaces:
canonical mg/dL stays as integers, mmol/L collapses to 1-decimal, and
the ADA diabetes thresholds (70/99/126) round-trip to their published
SI values (3.9 / 5.5 / 7.0 mmol/L).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(i18n): eliminate hydration flash by threading SSR-resolved locale to I18nProvider

Layout already resolves the initial locale from cookie + Accept-Language and
sets <html lang>. Until now the client I18nProvider re-detected locale at
mount via getSavedLocale() / detectSystemLocale(), causing a flash where
"Loading…" (EN) rendered first, then flipped to "Laden…" (DE) after
hydration. Pass initialLocale down layout -> Providers -> I18nProvider so
useState seeds the same locale the server used.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(admin/feedback): return 409 when GitHub issue already published

Spec requires 409 Conflict (not 200 with flag) when the feedback row
already has gitHubIssueUrl set. Drops the alreadyPublished response
field in favour of a clear error status.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(crypto,dashboard): L4 hard-fail short ENCRYPTION_KEY in prod + dashboard WIP from parallel agent

* refactor(effective-range): collapse duplicated glucose case arms

Extract glucoseRange() helper and toDate() normalizer. Use METRIC_BOUNDS
keys as the source of truth for getAllEffectiveRanges() metric list so
additions stay in one place.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(dashboard-layout-section): drop redundant setLayout alias

Remove the trivial setLayout wrapper and hoist the per-row label key
lookup so it runs once per widget instead of twice (span + aria-label).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(security): MED-1 SSRF on user AI baseUrl + MED-2 publish-to-GitHub race

Final-audit blockers before v1.2 merge.

MED-1 — SSRF via user-level LOCAL AI baseUrl
Authenticated user could set aiBaseUrl to http://169.254.169.254/,
http://localhost:9090/metrics, or any internal host and get response
bodies echoed back via the bodyExcerpt error field. Route the value
through the existing isPublicUrl() helper (exported from
lib/validations/notifications.ts). Ops can opt-in to private hosts on a
specific instance via ALLOW_LOCAL_AI_PRIVATE_HOSTS=true — that's how
self-hosted Ollama / LM Studio stays usable without exposing the SSRF
surface by default.

MED-2 — Race in POST /api/admin/feedback/[id]/github
Two concurrent admin clicks both saw gitHubIssueUrl=null and both
created duplicate GitHub issues. Atomic claim now: a single
updateMany({ where: { id, gitHubIssueUrl: null }, data: PENDING }) —
only the caller whose count=1 proceeds. PENDING is released on failure
so retries work.

Tests + typecheck green. Baseline lint unchanged.

* fix: i18n completeness + UX polish (closes #73, #74) (#75)

* fix(i18n,ux): package A — missing keys, chart labels, query invalidation, admin error UX

Addresses bugs surfaced in issues #73 and #74 plus drift found during audit.

- i18n: add 21 missing translation keys (targets.* namespace was only
  partially populated after the English-first migration; common.reset and
  settings.configured were referenced but absent), plus common helpers
  (copy, copyDetails, retry, reportIssue) and admin.settingsSaveError.
- charts: rename points7Label/30Label/90Label from cryptic "7P/30P/90P"
  to "7 pts / 30 pts / 90 pts" in EN and "7 Pkt / 30 Pkt / 90 Pkt" in DE.
- queries: add src/lib/query-keys.ts as a single source of truth with
  measurement/mood/medication-dependent key sets. Wire them into
  measurement-form/list, mood-form/list, medication-form/card,
  intake-history-list, intake-timeline, medications page, and Withings
  sync in settings. Fixes dashboard not auto-refreshing after adding a
  measurement (old code only invalidated ["measurements"], not
  ["analytics"] / ["insights"] / ["insights","targets"]).
- admin: useUpdateSettings + updateUser mutations now surface real error
  messages via sonner toasts and invoke getApiErrorMessage() so saves
  fail loudly instead of silently. Success also gets a toast.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(i18n): package B — locale-aware formatters throughout

Removes the hard-coded de-DE locale that lingered from the German-first era
and makes every number, date, and time locale-aware. English stays the
default per user preference; German remains selectable.

New:
- src/lib/format-locale.ts exposes makeFormatters(locale) + a cached
  Europe/Berlin timezone. Covers number, integer, percent, date, dateShort,
  dateTime, time, dateWithWeekday, monthShort. Also exports
  parseLocaleFromAcceptLanguage() for server code.
- useFormatters() hook in @/lib/i18n/context resolves from the active
  locale, memoized per render.

Migrated (all Intl.NumberFormat("de-DE") / toLocaleString("de-DE") /
Intl.DateTimeFormat("de-DE") call sites):
- src/app/page.tsx (dashboard)
- src/app/insights/page.tsx
- src/app/admin/page.tsx
- src/app/settings/page.tsx (Withings last-sync, doctor-report caller)
- src/components/charts/trend-card.tsx (+ i18n "7d"/"30d" short labels)
- src/components/charts/health-chart.tsx
- src/components/medications/medication-card.tsx
- src/components/medications/medication-form.tsx
- src/components/measurements/measurement-list.tsx
- src/components/mood/mood-list.tsx
- src/components/insights/insight-status-card.tsx (also removed 5 German
  hard-coded strings with TODO: i18n markers — now translated)
- src/components/insights/insight-advisor-card.tsx (same — 10+ strings)

Server: reminder-check / reminder-worker / umami-test switched from
"de-DE" to neutral en-GB/en-US where the string is machine-compared rather
than user-facing. Bug-report GitHub issue titles use ISO-8601 UTC now —
the repo is English-speaking.

Next.js metadata:
- OpenGraph locale from "de_DE" → "en_US" with "de_DE" as
  alternateLocale.
- Root layout now reads healthlog-locale cookie (falls back to
  Accept-Language) and sets <html lang> server-side, avoiding an
  EN-flashes-then-DE hydration gap and fixing SEO/a11y.
- I18nProvider mirrors locale to a 1-year SameSite=Lax cookie so the next
  SSR pass is correct.

Doctor-report PDF:
- generateDoctorReportPDF(data, { t, locale }) now accepts injected
  translator + locale. All section titles, column headers, BMI / BP
  classifications, mood labels, and the footer disclaimer are
  i18n-driven. File name slug switches between gesundheitsbericht / health-report.
- 40+ new doctorReport.* keys in EN + DE.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ux): package C — typed passkey errors, bug-report gating, error boundary

Addresses issue #73 points 1, 5, 6 and lays groundwork for copy-paste
error reporting requested during review.

Passkey registration / login (#73.1):
- src/lib/passkey-errors.ts maps DOMException.name + SimpleWebAuthn code
  to specific i18n keys instead of swallowing every failure as
  "cancelled". Distinguishes NotAllowed/InvalidState/NotSupported/
  Security/Abort errors and falls back to a diagnostic message.
- settings passkey + login passkey flows both use describePasskeyError
  now, so origin mismatches and previous-registration collisions show
  actionable copy.
- 5 new passkey.* i18n keys in EN + DE.

Bug report (#73.5):
- New GET /api/bugreport/status reports {configured, hasToken, hasRepo,
  isAdmin}.
- /bugreport page now queries status first. When not configured it shows
  a notice (different copy for admins vs. regular users) with a direct
  link to the admin panel. Form is hidden, not silently broken.
- When POST /api/bugreport can't create issues it returns 503 instead
  of 500 with the same user-facing message.
- 4 new bugreport.* i18n keys.

Global error UX:
- src/components/error-details.tsx — reusable panel with retry + copy
  diagnostics (message, digest, stack (trimmed), URL, user-agent,
  request-id, locale, timestamp) + report-issue link. Clipboard fallback
  prompt covers insecure-context cases.
- src/app/error.tsx uses it.
- src/app/global-error.tsx is provider-free (no i18n dependency) since
  it replaces the root layout on catastrophic failures — hardcoded
  English + Dracula palette so it still looks like HealthLog.
- 2 new errorBoundary.* keys and 4 common.* keys (copy, copyDetails,
  retry, reportIssue).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(query-keys): collapse repeated invalidation blocks into invalidateKeys helper

Eleven mutation handlers repeated `Promise.all(keys.map(k => invalidate({queryKey: k})))`
verbatim. Adds `invalidateKeys(qc, keys)` to the existing query-keys factory and
adopts it everywhere, including replacing the local `invalidateMedicationRelated`
helper that medication-form.tsx had grown. Also fixes the import-sandwich that
helper introduced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: small simplifications in i18n/UX changes

- passkey-errors: drop the typeof-name dance now that error.name is already string after the instanceof Error narrow
- doctor-report-pdf: replace nested gender ternary with a small lookup map; clarify unitFor's null-as-translation-marker convention
- dashboard page: route the analytics queries through the new queryKeys factory so future invalidation stays in one place
- health-chart: add missing fmt dependency to trendInfo useMemo (introduced when formatSigned was switched to the locale-aware formatter)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ai): capture upstream response body in OpenAI errors

A production insights burst at 12:19 UTC failed with "OpenAI request
failed (500)". The 500 was the upstream OpenAI HTTP status (confirmed
via logs), but we had no way to tell from logs whether it was an
OpenAI incident, a model-not-found, or a response_format rejection
because the response body was thrown away.

Now the error message includes the first 500 chars of the response body
and structured fields (httpStatus, upstream, model) that Wide Event
logging can attach. No behavior change for the happy path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(review): address code-review + security findings

Review round produced five real issues — fix them all, plus three nits
that were cheap enough to bundle.

Must-fix:
- security: error-details.tsx + global-error.tsx were copying
  window.location.href into the clipboard, which on OAuth callback
  routes (/api/withings/*, password reset) would leak code/state
  tokens into GitHub issues. Strip to pathname + searchParamCount.
- fe: query-keys.invalidateKeys now uses Promise.allSettled, so a
  transient invalidate failure doesn't abort the chain and no
  unhandled rejection leaks from void invalidateKeys(...) call sites.
- fe: resolveInitialLocale in app/layout.tsx wraps cookies()/headers()
  in try/catch — a dynamic-server error in the root layout now
  degrades to the "en" default instead of crashing into global-error.
- be: reminder-worker + reminder-check parseTimeToMinutes normalize
  "24:00" → "00:00" (some ICU builds emit that for midnight under
  en-GB). Prevents a 1440-minute comparison against schedule windows.
- security: openai-client error body excerpt redacts sk-* / Bearer
  tokens before logging, and moves the excerpt off Error.message into
  a structured field (bodyExcerpt) so log transports can filter it.
- i18n: /api/withings/connect German error message → English.
- i18n: /insights/page.tsx hardcoded "Fehler beim Laden" → t(...)

Hardening:
- /api/bugreport/status collapses to {configured, isAdmin} and adds
  a 30/min rate limit per user. Client interface updated.
- i18n/context.tsx: I18nProvider's initializer now reads the cookie
  (matches SSR) before falling back to localStorage or browser
  detection — eliminates the locale-flash hydration class.
- format.ts legacy helpers also read cookie first, matching SSR.

Tests:
- new src/lib/__tests__/format-locale.test.ts — 9 cases covering
  makeFormatters, parseLocaleFromAcceptLanguage, resolveIntlLocale
- new passkey-errors.test.ts — 8 cases covering every DOMException
  name and SimpleWebAuthn code we map
- new query-keys.test.ts — bundles + invalidateKeys allSettled
  semantics (incl. partial-failure test)

118 → 142 tests. All pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Marc-André Bombeck <marc@bombeck.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: restore Link import lost in merge

* fix(bugreport): remove stale loading + not-configured blocks lost in merge

The v1.2 built-in feedback refactor made status informational only — form
always renders. Main's merge re-introduced the pre-refactor blocker blocks
referencing undefined statusLoading/AlertCircle and broke the build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marc-André Bombeck <marc@bombeck.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Marc-André Bombeck <marc@bombeck.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-18 22:20:12 +02:00
Marc-André Bombeck 38309932f3 Initial release v1.0.0 
HealthLog — personal health-tracking PWA with weight, blood pressure,
pulse, mood tracking, medication compliance, Withings integration,
doctor report PDF export, and Dracula-themed UI.
 2026-03-10 20:14:33 +01:00