Introduces `withIdempotency()` in `src/lib/idempotency.ts` — wraps a
mutation handler so that a POST/PUT/PATCH/DELETE carrying an
`Idempotency-Key` header is replayed from the cached response instead of
running twice. Cache row is keyed by `(userId, key, method, path)` with
24h TTL; replays carry `X-Idempotent-Replay: true` so callers can
distinguish them.
Applied to the three mutation endpoints most exposed to client retries:
• POST `/api/measurements`
• POST `/api/mood-entries`
• POST `/api/medications/[id]/intake`
Without the header: zero behaviour change. Existing clients that don't
send the header simply skip the cache lookup.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Purely additive migration:
• users.display_name, users.healthkit_config_json,
users.healthkit_last_synced_at — all nullable, no default backfill needed.
• New table idempotency_keys for the per-user POST-replay cache,
unique on (user_id, key, method, path), plus expires_at index for
the future cleanup sweep.
• New table devices for native push-token registration. Token has a
unique index; re-registering moves ownership.
No existing column was altered; no data backfill; deploy is safe under
concurrent traffic.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds `POST /api/doctor-report/pdf` that returns a fully rendered PDF
(`Content-Type: application/pdf`) using the same jsPDF document the web
client builds locally, just executed server-side. Locale resolves from
explicit body param → `Accept-Language` → `de` fallback.
The existing `POST /api/doctor-report` JSON endpoint is unchanged; both
endpoints share `collectDoctorReportData()` so any future change to the
aggregation lands in one place. The render core (`doctor-report-pdf-core`)
is isomorphic — same code paths run in browser jsPDF and Node jsPDF.
Rate-limit (10/h per user) is shared between the two endpoints so the
quota cannot be doubled by mixing JSON and PDF requests.
Tests: 6 core tests (PDF header bytes, size, determinism, DE+EN, empty
data, jsPDF doc shape) + 5 route tests (401, 429, 200 happy-path with
content-type/disposition, default `days=90`, Accept-Language fallback).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`requireAuth()` keeps the existing cookie-session path as the primary check;
when no session cookie is present it now falls back to validating
`Authorization: Bearer hlk_*` against the existing `ApiToken` table
(HMAC-SHA-256 hash, expiry + revocation enforced).
Behaviour for browser clients is unchanged — the cookie path runs first
and short-circuits before the header lookup. `requireAdmin()` stays
cookie-only by design.
Wide-Event annotation tags `auth_method: "bearer"` so the source is
distinguishable in Loki. `auth.bearer.success` and `auth.bearer.failure`
audit entries record the token id + reason.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Past Claude / Superpowers session output (plans + design specs) was
landing in the public repo. Files stay on disk locally but are no
longer tracked. .gitignore extended to cover the usual AI-tooling
scratch directories (.claude/, .cursor/, .codex/, .aider*) so future
sessions don't sneak anything in either.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Full audit of every overlapping claim across the five top-level docs
against the v1.3.2 codebase. Fixes structural drift accumulated since
v1.2:
- README: API envelope was documented as `{ data, error, meta }` but the
actual helpers return `{ data, error }`. Architecture tree was missing
6 src/app/, 4 components/, 8 lib/ subdirectories that landed in
1.2/1.3 (auth, mood, charts, targets, notifications, bugreport,
gamification, settings, ai, feedback, insights, logging, moodlog,
monitoring, …). API Reference grew 4 new sections (Personalization,
Feedback + Tokens, Notifications, Admin) covering ~25 previously
undocumented endpoints. Route count `~60` → `100+`. Achievement count
`30+` → `38+`. i18n keys `1000+` → `1500+` with note about the new
integrity test.
- AGENTS.md: Status `v1.2.0` → `v1.3.2` with the body-composition / SSRF
/ GHCR / pg-boss-drain / blocking-CI / locale-integrity highlights.
Prisma `7.4` → `7.8`. Migrations `0001–0018` → `0001–0022`. Settings
page `13 sections / ~2100 lines` → `8 top-level sections / ~3150
lines` with the actual section IDs. Insights page line estimate
trimmed to `~1750`, section ID `medications` → `meds`.
NotificationChannel / EventType correctly described as `String`
fields (not Prisma enums) sourced from
`src/lib/notifications/types.ts`.
- CONTRIBUTING.md: UI-language statement was inverted ("UI text in
German" → English-default with German user-selectable, plus the
i18n integrity test). Dark-mode-only claim corrected — light/system
toggle exists in the topbar. Node `22+` → `20+` to match the README.
openssl recipe split: POSTGRES_PASSWORD uses base64 24, the three
hex secrets use hex 32. CI check list expanded to the 5-step
pipeline (typecheck, lint, test, format:check, build).
- CLAUDE.md: vitest config path `vitest.config.ts` → `vitest.config.mts`.
Bearer-token hashing labelled `HMAC-SHA256` (keyed by
`API_TOKEN_HMAC_KEY`) instead of plain SHA-256. Removed the
reference to a non-existent `docs/STATUS.md` and the overstated
`docs/{architecture,security,ops,API,ADRs}` directory list — the
long-form end-user docs live at docs.healthlog.dev, only audit notes
are local.
- SECURITY.md: pin example bumped from `:1.2.0` to `:1.3.2`.
Verified against code: 23 Prisma models, all listed endpoints exist,
all package.json versions match, every CHANGELOG v1.3.x claim
(SSRF guard, Withings 77/88 mapping, pg-boss SIGTERM drain, WCAG
44×44 touch targets, rate-limited threshold writes, N+1 fix in
/api/insights/comprehensive) traced to the actual implementation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Hotfix release closing #108 — the dashboard glucose tiles rendered the
raw i18n key, and the bug-report screenshot upload promised a feature
that never reached the published GitHub issue.
The bug-report form accepted an image attachment that was stored in the
local DB but never reached the published GitHub issue — GitHub does not
accept inline base64 data URIs in issue bodies and offers no public API
to attach images to an issue programmatically. The publisher only
appended a placeholder line ("**Screenshot:** A screenshot was attached
in the original report.") which was visibly misleading to anyone
reading the issue (#108).
- Drop the file input, preview, validation, and unused icons from
src/app/bugreport/page.tsx.
- Remove hasScreenshot from FeedbackInput and the corresponding line
from publish-github.ts so feedback promotion no longer adds the
misleading note (applies to legacy rows whose screenshots are still
stored locally).
- Update the admin feedback→GitHub call site to match the new shape.
The screenshotBase64 column, the screenshot ingest path on /api/feedback,
and the admin-side preview of previously-submitted screenshots are
unchanged — existing reports keep their attachments locally.
Both messages/en.json and messages/de.json had two top-level "targets"
blocks. JSON.parse silently keeps the last occurrence, and that block
was missing glucoseFasting/Postprandial/Random/Bedtime — so glucose
tiles on the dashboard rendered the raw key "targets.glucoseFasting"
instead of the translated label (#108).
Collapsed the duplicate into a single block, dropped a duplicate
bugreport.bugTitlePlaceholder shadowed within the same namespace, and
filled in dashboard.sleep / dashboard.steps which were falling back to
hard-coded English.
New test src/lib/__tests__/i18n-locale-integrity.test.ts walks the raw
JSON to detect duplicate keys at any depth and verifies en/de key
parity, so this class of silent shadowing fails the build going forward.
The ${VAR:?error} syntax in docker-compose.yml broke Coolify-style
deploys: that platform parses the compose file eagerly and stores the
fallback error string as the env-var value when the var is unset, which
then propagates into DATABASE_URL and breaks the running app with
P1000 auth failures.
Switched to plain ${VAR} interpolation. Validation moves into
docker-entrypoint.sh, which checks DATABASE_URL, SESSION_SECRET,
ENCRYPTION_KEY, API_TOKEN_HMAC_KEY before connecting to the database
and exits with a deploy-platform-agnostic error listing the unset vars.
The pre-existing settings-page monolith has multiple set-state-in-effect
patterns that can only be cleaned up properly when the 2100-line file
gets broken into per-section sub-components (planned for 1.4.0). Until
then, blocking lint would just gate every PR. TypeScript strict checks
remain blocking.
CI now blocks on ESLint, which surfaced two pre-existing useEffect
sync-from-server patterns. Annotated with targeted eslint-disable
comments and a note that the proper fix lives in 1.4.0 alongside the
settings-page split — refactoring derivation here would touch a
2100-line file.
Security review of #106 surfaced two HIGH-severity gaps in the SSRF
guard. Both are documented bypass classes with public CVE precedent
(github.com/projectdiscovery/nuclei-templates' SSRF templates list
hex and IPv4-mapped IPv6 explicitly).
- Hex-notation IPv4: 'http://0x7f.0.0.1' / 'http://0x7f000001' /
'http://0xa.0.0.1' all parse to internal addresses depending on
the runtime's URL semantics. Reject the raw form before parsing.
- Decimal-notation IPv4: 'http://2130706433' is 127.0.0.1, etc.
Reject any pure-numeric host of plausible IP length.
- IPv4-mapped IPv6: '[::ffff:127.0.0.1]' and the hex variant
'[::ffff:7f00:1]' both target loopback. Match either form and
apply the private-IPv4 check to the embedded address.
- '[::]' (IPv6 unspecified, alias for 0.0.0.0) blocked alongside
'[::1]'.
Refactored the per-octet private-range checks into isPrivateIpv4()
since both the IPv4 and the IPv4-mapped-IPv6 paths now use them.
Test suite extended with regression cases for hex, decimal, and
IPv4-mapped IPv6. Now 208/208 passing.
Bumps version, drafts CHANGELOG body, and adds total-body-water /
bone-mass mention to README's Key Features list. Tag will be created
post-merge to trigger the GHCR multi-arch build.
- New unit tests for isPublicUrl covering loopback, link-local, RFC1918,
CGNAT, IPv6 ranges, and the leading-zero IPv4 octal-bypass regression
(URL parser silently turns '010.0.0.1' into '8.0.0.1' — caught now).
- Strengthened isPublicUrl: pre-URL leading-zero check on the raw input,
bracket-aware IPv6, deny on malformed IPv4 quads instead of falling
through to 'public' (better safe than sorry on user-supplied URLs).
- New unit tests for measurement validation covering the new
TOTAL_BODY_WATER and BONE_MASS types: ranges, glucoseContext rejection
on non-glucose types, and unrecognised type rejection.
UX/a11y residuals from 2026-04-26 audit:
- bottom-nav: touch targets sized to WCAG 2.5.5 minimum (44x44 CSS px)
via min-h-11 min-w-11 on each Link. Nav height bumped to h-16 to
accommodate. Visual icon stays at 20px so design doesn't shift.
- phase-config-dialog: decorative coloured dot now aria-hidden because
the redundant text label ("Green"/"Yellow"/...) already conveys the
phase. Screen readers no longer announce a meaningless 'image' node.
- admin: 'Web Push' and 'Bug Report' labels were hard-coded English in
StatusItem and SettingsToggle calls; now go through t() with new
admin.integrationWebPush / admin.integrationBugReport keys (en + de).
- medication-card: false-positive en-CA / en-US locale audit findings
documented inline — those are intentional locale-independent helpers
(en-CA gives YYYY-MM-DD for day-comparison, en-US gives a parseable
string for the toBerlinDate timezone hack), not user-facing display.
Security hardening from 2026-04-26 audit:
- SEC-002: isPublicUrl() now uses a strict IPv4 parser that rejects
leading-zero forms like 010.0.0.1, which historically slipped past
the h.startsWith('10.') check. Also covers CGNAT (100.64/10),
IPv6 unique-local (fc00::/7), and additional metadata-service edge
cases. Documented as input-time only (DNS rebinding still possible
at fetch time).
- SEC-004: GitHub PAT is now redacted from logged error bodies in
publish-github.ts before flowing to Wide Events / Loki. Adds an
escapeRegex helper for safe RegExp construction.
- SEC-006: PUT /api/user/thresholds now goes through checkRateLimit
(30 writes / 5 min, per-user) — audit-log was already there but
unbounded. Makes audit-log enumeration unattractive.
- PERF-001: insights/comprehensive route now batches medication-intake
events into a single 'medicationId IN (...)' query and groups in
memory instead of N+1 per medication. Latency was scaling poorly
for users with many active meds.
- REL-003: pg-boss now installs SIGTERM/SIGINT handlers that call
boss.stop({ graceful: true, timeout: 30s }) so in-flight handlers
drain on docker stop / coolify redeploy instead of being killed.
- LOG-001: Replaced console.log/error in reminder-worker with a
workerLog helper. Lifecycle errors still go to stderr (only audience
outside any handler context); routine init messages are silent
because pg-boss own events + Wide Events from handlers carry the
state.
- CI: ESLint and TypeScript checks are now blocking — continue-on-error
removed. Tests already were. Required pre-existing 'any' types in
api-handler.ts to be properly justified with eslint-disable comments
(Next.js variadic handler signature; the bound type still constrains
return to Promise<Response>).
- Adds TOTAL_BODY_WATER and BONE_MASS to MeasurementType enum
- Migration 0022 (purely additive ALTER TYPE ... ADD VALUE)
- Both stored canonically in kilograms (matches Withings hydration/bone mass measures and Health Connect TotalBodyWaterRecord/BoneMassRecord)
- Validation, formatters, i18n keys (en + de) for measurement form and doctor-report PDF
- Dashboard widgets registered (default-invisible, opt-in via settings)
- Withings client maps measure types 77 (hydration) and 88 (bone mass)
- Doctor report PDF includes both new types in vital-signs table when data exists
Issue #88's biggest blocker was that docs and README pointed at
ghcr.io/mbombeck/healthlog:latest, but no workflow ever pushed an
image — every self-hoster trying to follow the docs hit "manifest
unknown".
This adds .github/workflows/docker-publish.yml. The workflow:
- Triggers on push to main, on v* tags, on PRs (build only, no push),
and via workflow_dispatch
- Builds linux/amd64 + linux/arm64 multi-arch images via buildx
- Tags with `latest` (main only), semver (`1.2.0`, `1.2`), branch name,
PR number, and short SHA — using docker/metadata-action defaults
- Attaches SLSA build provenance and an SBOM to every image
- Caches build layers in GitHub Actions cache for fast iterations
- Uses concurrency group + cancel-in-progress so superseded runs stop
The bundled docker-compose.yml now references
`ghcr.io/mbombeck/healthlog:latest` as the primary `image:` and keeps
`build:` as a fallback so contributors can still
`docker compose up --build` against their working tree.
SECURITY.md gains a Supply Chain section explaining where images come
from, how to verify provenance and SBOMs, and how to pin a specific
version. README's Quick Start updated to reflect that no build is
needed for self-hosters.
The first run of this workflow on main will publish the image; until
then `docker compose up` will fall back to the `build:` block.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Issue #87 (kevinpapst): medications added during onboarding were
never visible afterwards. Root cause: the createMedication schema
requires schedules.min(1) ("Mindestens ein Zeitfenster"), but the
onboarding wizard sent schedules:[]. The 422 was silently swallowed
and the user was redirected to the dashboard as if everything had
worked.
This patch is the minimal-impact fix. The proper fix lives in Phase
3.5 of the audit plan, which replaces the wizard entirely with a
dashboard-first empty-state flow. Until then:
- finishOnboarding() wraps each call in a try/catch, checks
response.ok explicitly, and surfaces a sonner toast on failure.
setSaving(false) on error so the user can retry instead of being
stuck on a spinner.
- Each medication is sent with a default schedule (08:00-09:00) so
it is actually persisted. A new medScheduleHint i18n key is shown
under the meds list while the user is in the wizard, so the
default schedule is not surprising.
- Errors are translated per stage (errorProfile, errorMedication
with {name}, errorTargets) plus an errorGeneric fallback. en.json
and de.json kept symmetric.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
package.json was still on 1.1.0 even though CHANGELOG and the released
features (Custom Thresholds, Glucose, Dashboard Customization,
Built-in Feedback, Multi-Provider AI) shipped as 1.2.0 on 2026-04-18.
CLAUDE.md and AGENTS.md said 21 / 22 models in different places; the
schema actually has 23. Feedback (added in v1.2 for the in-app
bug-report flow) was missing from the model list in AGENTS.md, and
AGENTS.md still claimed status "Feature-complete (v1.0.0)".
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Issue #88 (kevinpapst): the bundled docker-compose.yml didn't actually
work. Three concrete blockers:
- expose:3000 → ports:"3000:3000" so the host can reach the app
- POSTGRES_PASSWORD was hard-coded to "healthlog" — now required via
env var, and DATABASE_URL inside the compose service interpolates
the same variable so the two cannot drift apart
- .env.example DATABASE_URL pointed at localhost:5432, which never
resolves inside the app container; replaced with db:5432 plus a
note explaining the local-dev variant
.env.example is also rewritten as proper documentation: each variable
explains what it does, why it matters, and how to generate it
(openssl rand -hex 32 for the three 32-byte secrets, openssl rand
-base64 24 for the Postgres password). Required vs optional are now
clearly grouped.
README Quick Start gives a realistic time estimate, generates the four
secrets in one block straight into .env, and points reverse-proxy
users at the docs site.
Pre-built GHCR images and a docs-vs-repo single-source-of-truth for
docker-compose are tracked separately in Phase 2 of the audit plan
(see docs/audit/2026-04-26-PLAN.md).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captures the eight-phase remediation plan synthesized from the
2026-04-26 multi-agent audit covering Issues #87, #88, #89 and the
broader codebase health (security, perf, reliability, i18n, a11y,
test coverage, docs consistency).
Plan reorders the original sequence to do the typed apiClient refactor
(Phase 4) BEFORE the onboarding redesign (Phase 3.5), so the new flow
inherits the .ok-checked client wrapper and the silent-failure class
of bugs (root cause of #87) is structurally eliminated rather than
re-introduced.
Custom measurement types are explicitly deferred to v1.5+ via the
Cronometer pattern when user demand crosses a threshold; v1.3 ships
TBW + Bone Mass hardcoded (#89, Phase 3) following the v1.2 glucose
blueprint.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
