Three fixes from the 5-way review on PR #117:
1. Insights cards: replace per-medication N+1 query with single batched
findMany + JS bucketing. For users with many active medications this
collapses 10+ sequential round-trips into one.
2. Idempotency cache: only persist 2xx/3xx and validation 4xx responses.
401/403/408/429/5xx are now skipped — a stale 401 (token expired
mid-flight) or transient 5xx must not be replayed for 24h. Adds a
defence-in-depth check that refuses to cache any body containing
"hlk_" so a future caller wrapping an auth route in withIdempotency
cannot leak a freshly-issued bearer token through the cache.
3. Devices: reject cross-user token re-registration with 409. Prior
behaviour silently transferred ownership on findUnique-by-token,
which would let anyone who learns/guesses an APNs token redirect
another user's pushes. Audit-logs the denial with reason.
Tests adjusted: device-hijack test now expects 409, plus a new test
for same-user re-registration. 279/279 tests passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces `withIdempotency()` in `src/lib/idempotency.ts` — wraps a
mutation handler so that a POST/PUT/PATCH/DELETE carrying an
`Idempotency-Key` header is replayed from the cached response instead of
running twice. Cache row is keyed by `(userId, key, method, path)` with
24h TTL; replays carry `X-Idempotent-Replay: true` so callers can
distinguish them.
Applied to the three mutation endpoints most exposed to client retries:
• POST `/api/measurements`
• POST `/api/mood-entries`
• POST `/api/medications/[id]/intake`
Without the header: zero behaviour change. Existing clients that don't
send the header simply skip the cache lookup.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
