HealthLog

831 Commits 8 Branches 543 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Marc-André BombeckandClaude Opus 4.7	a4e4aaf009	fix(security): replace isAllowedUmamiUrl with the canonical isPublicUrl guard `/api/send` is the public Umami proxy. The hand-rolled allowlist it carried predated the central `isPublicUrl` helper in `src/lib/validations/notifications.ts` and was missing every notation-bypass class the helper catches: - 100.64.0.0/10 CGNAT - 0.0.0.0/8 (only the literal `0.0.0.0` was matched) - 169.254/16 outside the AWS metadata IP (e.g. azure metadata is `169.254.169.254` too, but other addresses in the block are routable to other internal endpoints) - IPv6 ULA (`fc00::/7`) - IPv4-mapped IPv6 (`::ffff:127.0.0.1`) - Leading-zero IPv4 octal bypass (`http://010.0.0.1` → 8.0.0.1) - Hex IPv4 (`http://0x7f.0.0.1`) - Pure-decimal IPv4 (`http://2130706433`) The dev-mode escape hatch is also dropped — serving the proxy against a localhost / RFC1918 Umami target was never a useful configuration anyway, since the proxy sends the visitor's user-agent + body upstream which only makes sense against an externally-reachable analytics host. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 00:08:26 +02:00
Marc-André Bombeck	ca03c6099f	chore(release): v1.4.24 Security + accessibility hardening release. Closes the highest-priority findings from a focused security audit of the v1.4.23 release: - Bearer auth fail-closed when a route declares no scope (api-handler) - Public /api/send Umami proxy now rate-limits 120 req/min/IP - Proxy nonce generation switched to btoa(...) for Edge portability - Session-expiry delete race uses deleteMany + catch (no more 500s) - POST /api/import returns the standard apiError envelope on 422 - Runtime Docker image pins Prisma 7.8 + worker deps to minors - Notifications page renders a real load-error alert - Accessibility: switch aria-labels, htmlFor pairing, mobile admin Overview link, deep-link anchors on notification settings - Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/ sleep/steps overlay keys, TrendCard layout tolerates long labels Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244) && pnpm format:check all green.	2026-05-12 22:33:35 +02:00
Marc-André Bombeck	38309932f3	Initial release v1.0.0 HealthLog — personal health-tracking PWA with weight, blood pressure, pulse, mood tracking, medication compliance, Withings integration, doctor report PDF export, and Dracula-themed UI.	2026-03-10 20:14:33 +01:00

Author

SHA1

Message

Date

Marc-André BombeckandClaude Opus 4.7

a4e4aaf009

fix(security): replace isAllowedUmamiUrl with the canonical isPublicUrl guard

`/api/send` is the public Umami proxy. The hand-rolled allowlist it
carried predated the central `isPublicUrl` helper in
`src/lib/validations/notifications.ts` and was missing every
notation-bypass class the helper catches:

- 100.64.0.0/10 CGNAT
- 0.0.0.0/8 (only the literal `0.0.0.0` was matched)
- 169.254/16 outside the AWS metadata IP (e.g. azure metadata is
  `169.254.169.254` too, but other addresses in the block are
  routable to other internal endpoints)
- IPv6 ULA (`fc00::/7`)
- IPv4-mapped IPv6 (`::ffff:127.0.0.1`)
- Leading-zero IPv4 octal bypass (`http://010.0.0.1` → 8.0.0.1)
- Hex IPv4 (`http://0x7f.0.0.1`)
- Pure-decimal IPv4 (`http://2130706433`)

The dev-mode escape hatch is also dropped — serving the proxy against
a localhost / RFC1918 Umami target was never a useful configuration
anyway, since the proxy sends the visitor's user-agent + body upstream
which only makes sense against an externally-reachable analytics host.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-27 00:08:26 +02:00

Marc-André Bombeck

ca03c6099f

chore(release): v1.4.24

Security + accessibility hardening release. Closes the highest-priority
findings from a focused security audit of the v1.4.23 release:

- Bearer auth fail-closed when a route declares no scope (api-handler)
- Public /api/send Umami proxy now rate-limits 120 req/min/IP
- Proxy nonce generation switched to btoa(...) for Edge portability
- Session-expiry delete race uses deleteMany + catch (no more 500s)
- POST /api/import returns the standard apiError envelope on 422
- Runtime Docker image pins Prisma 7.8 + worker deps to minors
- Notifications page renders a real load-error alert
- Accessibility: switch aria-labels, htmlFor pairing, mobile admin
  Overview link, deep-link anchors on notification settings
- Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/
  sleep/steps overlay keys, TrendCard layout tolerates long labels

Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244)
&& pnpm format:check all green.

2026-05-12 22:33:35 +02:00

Marc-André Bombeck

38309932f3

Initial release v1.0.0

HealthLog — personal health-tracking PWA with weight, blood pressure,
pulse, mood tracking, medication compliance, Withings integration,
doctor report PDF export, and Dracula-themed UI.

2026-03-10 20:14:33 +01:00