tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 12:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,301 Commits 11 Branches 539 Tags
a7faae8ded7e11ebd71aeedf1f0349ba767ea5e5
Commit Graph
6301 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marc-André Bombeck 27a3e08436 fix(01-07): make private Nightscout access operator-owned 
- remove the user-facing private-host bypass
- render a redacted operator-action state for denied legacy connections
 2026-07-29 13:57:48 +02:00
Marc-André Bombeck f95da50ba0 fix(01-07): enforce exact Nightscout origins 
- move private-host authority to the server-owned exact-origin policy
- preserve stable redacted policy failures through connect and sync
 2026-07-29 13:57:07 +02:00
Marc-André Bombeck b7b18a6da2 fix(01-08): align passkey request fixture typing 
- construct NextRequest options with the framework-compatible init type
- preserve every enrollment security assertion unchanged
 2026-07-29 13:55:57 +02:00
Marc-André Bombeck 9c661dcc5e fix(01-08): revoke credentials atomically on password reset 
- lock the resolved account and rotate its password in one transaction
- revoke sessions, tokens, trusted devices, and elevations with rollback safety
 2026-07-29 13:55:11 +02:00
Marc-André Bombeck 7874eea04d feat(01-08): require reauthentication before passkey enrollment 
- offer password, TOTP, passkey, and security-key proof choices
- start registration only after the selected existing factor succeeds
 2026-07-29 13:53:59 +02:00
Marc-André Bombeck 89c83510d4 feat(01-08): bind passkey enrollment to fresh cookie proof 
- require an existing-factor proof before issuing registration options
- atomically claim session-bound challenges before credential persistence
 2026-07-29 13:52:22 +02:00
Marc-André Bombeck 9cb11abedb docs(01-05): complete MCP security enforcement plan 
- record green scope and PostgreSQL replay-family gates
- document transactional rotation and post-commit artifact semantics
 2026-07-29 13:52:03 +02:00
Marc-André Bombeck db08f6c175 fix(01-05): serialize MCP refresh families 
- lock and rotate refresh families inside one database transaction
- revoke CAS losers and insert successors before commit
- sign refresh artifacts only after committed state
 2026-07-29 13:50:14 +02:00
Marc-André Bombeck a177869609 fix(01-07): classify embedded IPv4 destinations 
- Normalize IPv6 literals before transition-prefix inspection
- Reject mapped, compatible, 6to4, and NAT64 private embeddings
- Share the verdict with pinned public and operator dispatchers
 2026-07-29 13:49:49 +02:00
Marc-André Bombeck 36cb64c840 test(01-02): exercise DNS transition cases past fetch port guard 
- replace blocked port 9 with non-blocked test port 8089
- preserve pre-connect ENOTFOUND assertions for all transition forms
 2026-07-29 13:49:46 +02:00
Marc-André Bombeck 20a6731c8b fix(01-05): enforce MCP health read scope 
- require health:read or wildcard for MCP read capability
- reject insufficient scopes before downstream gates and server construction
 2026-07-29 13:47:46 +02:00
Marc-André Bombeck 8ca6ebd773 docs(01-06): complete PWA cache isolation plan 
- document public-only install and data-free offline behavior
- record scoped current and legacy cache eviction
- capture green final-boundary and session-hook verification
 2026-07-29 13:47:17 +02:00
Marc-André Bombeck 338dbe6c1f fix(01-06): purge owned PWA caches on session end 
- delete current and legacy HealthLog static page and data caches
- preserve unrelated CacheStorage namespaces during activation and logout
- keep IndexedDB query-cache removal in the session-end boundary
 2026-07-29 13:46:15 +02:00
Marc-André Bombeck 31248ec273 docs(01-01): complete MCP security red contracts plan 
- record expected-red authorization and refresh-race evidence
- hand off exact enforcement targets to Plan 01-05
 2026-07-29 13:45:42 +02:00
Marc-André Bombeck 8851569658 fix(01-06): isolate PWA install from authenticated root 
- remove the dashboard root from immutable precaching
- evict same-version root entries left by older workers
- retain public logos and favicon for offline support
 2026-07-29 13:45:23 +02:00
Marc-André Bombeck 0c29e6e6b0 test(01-01): keep bearer regression lint-clean 
- avoid React hook-name classification for token fixture helpers
 2026-07-29 13:44:28 +02:00
Marc-André Bombeck 8b5e928efa docs(01-03): complete credential security contracts plan 
- document passkey enrollment and reset recovery RED boundaries
- record focused expected failures and green parity evidence
- preserve production, schema and scanner-owned files untouched
 2026-07-29 13:43:49 +02:00
Marc-André Bombeck 51f5f43957 test(01-01): preserve explicit transaction contract 
- keep the red transaction-client call aligned with the planned signature
- isolate the concurrent documentation commit from MCP test content
 2026-07-29 13:43:27 +02:00
Marc-André Bombeck 390c718b74 test(01-01): reproduce MCP refresh replay race 
- coordinate concurrent exchanges with a real PostgreSQL row-lock barrier
- verify family-wide successor revocation and cross-connection isolation
 2026-07-29 13:42:30 +02:00
Marc-André Bombeck cc8567d82f docs(01-02): complete PWA and SSRF red contracts plan 
- document expected cache-isolation and transition-form failures
- record preserved public and redirect behavior
- capture atomic task commits and verification evidence
 2026-07-29 13:42:30 +02:00
Marc-André Bombeck abea48026b test(01-03): add atomic reset revocation contracts 
- execute the operator CLI against real PostgreSQL credential tables
- require complete target revocation and unrelated-admin isolation
- force a mid-transaction database failure to prove rollback
 2026-07-29 13:42:04 +02:00
Marc-André Bombeck eb5cd5fbcb docs(01-04): complete Nightscout security contract plan 
Tasks completed: 3/3
- Specify exact operator-origin configuration
- Pin connect-time and sync-time egress policy
- Pin the user-facing breaking-change state
 2026-07-29 13:41:52 +02:00
Marc-André Bombeck 38501f6574 test(01-01): specify transactional refresh rotation 
- require one transaction for rotation and successor insertion
- pin CAS-loss revocation and insertion rollback semantics
 2026-07-29 13:40:03 +02:00
Marc-André Bombeck 3f4afb26a4 test(01-03): pin passkey enrollment reauthentication UX 
- require password, passkey, TOTP and WebAuthn proof choices
- order fresh-factor completion before challenge creation
- keep successful enrollment in one cookie-bound ceremony
 2026-07-29 13:39:55 +02:00
Marc-André Bombeck e25080b214 test(01-02): add red DNS-pinned SSRF contracts 
- refuse standard embedded-private IPv6 resolver answers pre-connect
- preserve public IPv6 to IPv4 fallback connectivity
- prove followed redirects repeat the pinned DNS verdict
 2026-07-29 13:39:52 +02:00
Marc-André Bombeck 5569b8259b test(01-04): pin Nightscout operator-action UI 
- Remove the user-facing private-host bypass contract
- Require redacted operator approval guidance for legacy failures
- Preserve usable public and approved-private connected states
 2026-07-29 13:39:50 +02:00
Marc-André Bombeck 14f451093e test(01-04): pin Nightscout egress enforcement 
- Deny user-authorized and mismatched private origins before network access
- Preserve exact operator-private and public positive flows
- Require stable redacted policy reasons through sync boundaries
 2026-07-29 13:39:06 +02:00
Marc-André Bombeck 9f6cd86c0d test(01-03): add passkey enrollment security contracts 
- require fresh existing-factor proof on both cookie-only legs
- bind registration challenges to user, purpose, session, expiry and one use
- cover bearer, ambient-cookie, stale, foreign and replay attacks
 2026-07-29 13:38:53 +02:00
Marc-André Bombeck 6c0f47acad test(01-01): pin MCP read scope boundaries 
- cover health read and wildcard positive capability paths
- reject unrelated scopes before server registration and database reads
 2026-07-29 13:38:41 +02:00
Marc-André Bombeck fb533147d3 test(01-02): add red IPv6 transition classifier matrix 
- cover mapped compatible 6to4 and NAT64 private embeddings
- exercise both literal URL and raw DNS address verdicts
- preserve public IPv4 native IPv6 and transition forms
 2026-07-29 13:38:11 +02:00
Marc-André Bombeck 3a813b51bd test(01-02): add red PWA cache isolation contracts 
- exercise signed-in service-worker install at CacheStorage boundary
- require data-free offline navigation and immutable public assets
- require current and legacy session cache cleanup
 2026-07-29 13:37:20 +02:00
Marc-André Bombeck 668f85a58d test(01-04): specify exact Nightscout origin policy 
- Parse canonical server-owned private origins
- Reject malformed and non-exact trust grants
- Preserve public and approved-private positive contracts
 2026-07-29 13:36:46 +02:00
Marc-André Bombeck 6528d9f289 Rewrite the v1.34.0 dedication 
Name everyone who opened an issue, not just the three tied to a
specific fix. Drop the sponsorship amount; it was never the point
and stays private.
 2026-07-29 00:42:50 +02:00
Marc-André Bombeck b4d218f511 Merge pull request #663 from MBombeck/release/v1.34.0 
v1.34.0
v1.34.0 		2026-07-28 23:39:33 +02:00
Marc-André Bombeck e7c6610c63 fix(e2e): re-target compare-to tap-target check at the per-chart overlay popover 2026-07-28 23:24:53 +02:00
Marc-André Bombeck 1d784c6367 fix(analytics,ci): merge health-score meta annotations, migrate integration tests, remove dead exports, raise bundle budget 2026-07-28 23:02:00 +02:00
Marc-André Bombeck 668e3ca6b6 fix(insights,settings): restore hero-strip column width, gate hero fieldset on hydration 2026-07-28 22:03:39 +02:00
Marc-André Bombeck 41a18813d1 chore(release): sync service-worker version fallback to 1.34.0 2026-07-28 21:50:22 +02:00
Marc-André Bombeck 17e09345d2 chore(release): v1.34.0 — a failure looks like a failure, a number is yours or it says so 2026-07-28 21:49:56 +02:00
Marc-André Bombeck 2bab06e323 feat(medications): resolve each dose slot's own window duration 2026-07-28 21:26:53 +02:00
Marc-André Bombeck ff8ead2db9 fix(analytics): repair route/i18n/guard fallout from health-score merge 2026-07-28 21:19:18 +02:00
Marc-André Bombeck 7b8fb98e48 feat(analytics): replace health score with reference composite 2026-07-28 21:12:05 +02:00
Marc-André Bombeck 93e1b83779 test(api): guard response field consumers 2026-07-28 21:11:56 +02:00
Marc-André Bombeck d9880b0562 test: cover every measurement source write path 2026-07-28 21:11:50 +02:00
Marc-André Bombeck 3aff2c16db fix(insights): scope generation guard to prompt fields, clear cache on restore 2026-07-28 21:11:43 +02:00
Marc-André Bombeck c91558f18f feat(analytics): replace health score with reference composite 2026-07-28 21:10:15 +02:00
Marc-André Bombeck 87544af2cd Fix medication reminder slot attribution 2026-07-28 21:06:07 +02:00
Marc-André Bombeck af47bae046 test(api): guard response field consumers 2026-07-28 21:05:42 +02:00
Marc-André Bombeck f201fb32e7 test: cover every measurement source write path 2026-07-28 15:12:23 +02:00
Marc-André Bombeck 666a85d311 feat(insights): persist correlation patterns 2026-07-28 14:01:11 +02:00