Marc-André Bombeck
afae57207c
feat: scope shared record navigation
2026-08-06 04:13:59 +02:00
Marc-André Bombeck
cb15100341
test: cover scoped record navigation
2026-08-06 04:13:54 +02:00
Marc-André Bombeck
201a24e404
Merge managed record settings
2026-08-06 04:05:16 +02:00
Marc-André Bombeck
437d916fc6
fix: guard managed setting label inventories
...
- Treat inherited property names as unavailable settings
- Preserve legacy tile aliases only for declared entries
2026-08-06 04:01:00 +02:00
Marc-André Bombeck
24c5c49be3
fix: remove unused managed setting labels
...
- Keep closed display inventories as the only rendered labels
2026-08-06 03:55:37 +02:00
Marc-André Bombeck
6a1d1dd6e8
fix: preserve managed target defaults
...
- Return effective threshold ranges after managed updates\n- Localize closed Coach and Insights display inventories
2026-08-06 03:52:49 +02:00
Marc-André Bombeck
5a9f8a0df6
Merge managed profile lifecycle
2026-08-06 03:44:16 +02:00
Marc-André Bombeck
247ac8494c
fix: complete managed record settings
...
- Expose canonical defaults and reject invalid settings families\n- Localize Guardian controls and refresh dependent caches
2026-08-06 03:40:13 +02:00
Marc-André Bombeck
e788675b82
feat: configure managed record settings
...
- Scope writable settings to the selected managed record\n- Render typed Guardian controls with separated audit attribution
2026-08-06 03:21:02 +02:00
Marc-André Bombeck
389f2a042b
fix: complete managed Guardian invitation lifecycle
2026-08-06 03:19:34 +02:00
Marc-André Bombeck
493437207e
test: cover managed Guardian invitation lifecycle
2026-08-06 03:14:47 +02:00
Marc-André Bombeck
32380b1935
fix: clear revoked Guardian sessions
...
Return a removed Guardian's browsers to their own record.
2026-08-06 03:08:51 +02:00
Marc-André Bombeck
ffe3225639
fix: complete managed Guardian lifecycle
...
Use locked Guardian membership and transactional lifecycle audits.\n\nKeep acceptance and marker changes atomic.
2026-08-06 03:05:19 +02:00
Marc-André Bombeck
55291ad32d
test: cover managed Guardian lifecycle races
...
Exercise cookie routes, transaction rollback, and record-serialized races.
2026-08-06 03:01:12 +02:00
Marc-André Bombeck
523ab3220b
fix: serialize managed profile Guardians
...
Protect every Guardian-reducing lifecycle transition with a record lock.\n\nReturn a recoverable refusal when the final Guardian remains.
2026-08-06 02:50:30 +02:00
Marc-André Bombeck
b639b064f9
test: register managed record settings routes
...
- Freeze the guardian-only settings endpoints\n- Require an explicit purpose for both routes
2026-08-06 02:42:01 +02:00
Marc-André Bombeck
03ee01ba56
feat: show managed integration status
...
- Render a record-keyed status view for managed profiles\n- Refuse shared Settings links before actor controls mount\n- Localize intentional unavailable states
2026-08-06 02:38:54 +02:00
Marc-André Bombeck
5059bc9b69
test: cover managed profile Guardian races
...
- Exercise concurrent final-Guardian reductions against Postgres\n- Cover recoverable account and profile deletion paths
2026-08-06 02:36:08 +02:00
Marc-André Bombeck
e5e3590ca3
feat: add managed profile Guardians
...
- Keep the ordinary invitation consent flow for a second Guardian\n- Clear managed Guardian expiry when the invitation is accepted
2026-08-06 02:32:59 +02:00
Marc-André Bombeck
665f223dc4
test: cover managed profile Guardian consent
...
- Pin ordinary second-Guardian acceptance\n- Pin non-expiring accepted Guardian grants
2026-08-06 02:29:55 +02:00
Marc-André Bombeck
54cd3e3959
test: cover managed integration status
...
- Require the record-scoped status query\n- Keep integration controls out of the managed view
2026-08-06 02:29:04 +02:00
Marc-André Bombeck
58434a2b44
feat: create managed profiles atomically
...
- Require a fresh cookie MFA proof before creation\n- Create the credential-less profile and initial Guardian grant together
2026-08-06 02:28:56 +02:00
Marc-André Bombeck
d95c48f48d
feat: classify managed record settings
...
- Inventory every Settings destination as an explicit access class\n- Fail closed for unknown deep-link destinations
2026-08-06 02:28:29 +02:00
Marc-André Bombeck
d965076609
test: cover settings classification
...
- Require a literal settings inventory\n- Limit Guardian configuration to the approved subset
2026-08-06 02:27:27 +02:00
Marc-André Bombeck
009de7cb5f
feat: add record keyed settings
...
- Separate managed record settings from actor identity\n- Limit integration reads to the active managed record
2026-08-06 02:26:44 +02:00
Marc-André Bombeck
1eb0d22285
test: add record settings contract
...
- Cover record-keyed DTO and cache behavior\n- Pin actor identity separately from the active record
2026-08-06 02:25:53 +02:00
Marc-André Bombeck
51cbbae17f
test: cover managed profile creation
...
- Prove truthful profile attributes and the initial Guardian grant\n- Prove grant-write failure rolls the profile transaction back
2026-08-06 02:25:19 +02:00
Marc-André Bombeck
c3125078b9
chore: resolve sharing lint checks
...
Keep attribution and provider-work tests lint-clean.
2026-08-06 02:13:50 +02:00
Marc-André Bombeck
d404d8275a
fix: preserve import job wipe ownership
...
Keep durable actor attribution from deleting record-owned jobs.
Align provider and idempotency coverage with fail-closed behavior.
2026-08-06 02:11:01 +02:00
Marc-André Bombeck
f5ca810643
chore: format sharing authority controls
...
Apply repository formatting to provider and import coverage.
2026-08-06 02:05:24 +02:00
Marc-André Bombeck
a620a730b9
test: extend sharing boundary guards
...
Cover provider work authority and import actor attribution.
2026-08-06 02:04:04 +02:00
Marc-André Bombeck
620817b10b
fix: retain import actor attribution
...
Persist record and actor identities through job completion.\nWrite one bounded transactional completion audit per job.
2026-08-06 02:00:35 +02:00
Marc-André Bombeck
adb932052c
fix: keep managed system work operator-scoped
...
Resolve managed record credentials through the operator policy for system work.
2026-08-06 01:53:04 +02:00
Marc-André Bombeck
2b2080f48c
test: pin import actor attribution
...
Cover durable record and actor attribution across completion retries.
2026-08-06 01:52:43 +02:00
Marc-André Bombeck
e209db24f4
fix: block delegated provider egress
...
Carry bounded work authority through queues and revalidate it at dispatch.\nResolve shared records without personal credentials.
2026-08-06 01:49:33 +02:00
Marc-André Bombeck
f7a06df2bc
test: pin provider origin controls
2026-08-06 01:38:35 +02:00
Marc-André Bombeck
60b842f614
fix: reauthorize delegated replay
...
- Recheck the live grant before returning cached delegated responses
- Refuse cached replay when the acting record cannot be resolved safely
2026-08-06 01:29:07 +02:00
Marc-André Bombeck
f8b05d541e
test: pin delegated replay revocation
...
- Cover active, revoked, and own-record cache replay against Postgres
2026-08-06 01:22:33 +02:00
Marc-André Bombeck
09ff1fb23d
feat: enforce managed sharing boundaries
2026-08-06 01:16:18 +02:00
Marc-André Bombeck
d86358f3e4
fix: recover managed sharing boundaries
2026-08-06 00:19:35 +02:00
Marc-André Bombeck
01562b4aef
test: use the shared browser test entry point
2026-08-06 00:08:54 +02:00
Marc-André Bombeck
8669df4cda
feat: add scoped record invitations
2026-08-05 23:58:30 +02:00
Marc-André Bombeck
4923db6464
fix: preserve account access compatibility
2026-08-05 23:58:26 +02:00
Marc-André Bombeck
e4e773d543
feat: define scoped sharing levels
2026-08-05 23:58:18 +02:00
Marc-André Bombeck
ab14fdb6f3
Let an invitation name its sections and offer management
...
An owner can now narrow a grant to the parts of their record they mean to
share, and can offer the third level. Both decisions are made once, on the
invitation, and neither widens afterwards.
The invite schema takes `scope`: absent or null is the entire record, which
is what every stored grant means and what an owner who does not narrow still
gets. An empty array, a key outside the vocabulary and the whole-record
sentinel are each refused with a 422 naming the field; `inviteGrant` refuses
the same three underneath, and its `invalid_scope` now has an HTTP mapping
instead of falling into the generic refusal.
Offering MANAGE asks for a fresh second factor when the account has one. That
gate resolves through the session cookie and has no Bearer fall-through, so a
token caller is refused first with `sharing.invite.manage_browser_only` rather
than being told it is not authenticated by a route that had just
authenticated it. The consequence is deliberate: management of a health
record is offered from a browser.
The account payload gains `sections` and `level` beside `access` and
`canWrite`, resolved server-side and ordered as the consent screen reads.
`access` was `grant.access === "WRITE" ? "write" : "read"`, which would have
published a grant that can delete entries as read-only; it is a total map
now, so the next level cannot ship silent. The capabilities hook carries both
facts and turns neither into an affordance yet — the edit and delete controls
come back in the release where the routes behind them answer.
The consent surface asks two questions in order rather than laying out a
nineteen-cell grid. The level is three radios, narrowest preselected. What
they can open is two radios, the entire record preselected, and only the
narrow branch expands the eight sections with a sentence each. Both honest
limits are stated above the checkboxes, where the decision is being made: a
section shares everything written in it, and the cross-record surfaces do not
appear for a narrowed grant. Documents carries its own warning, cycle appears
only for an owner who tracks it, and Manage collapses the question to the one
line that answers it.
The Manage sentence says the other person can add, change and remove entries,
including ones the owner entered themselves, and says in the same breath what
it does not reach. The acceptance side gets its own responsibility line rather
than the write one wearing a stronger adjective.
Six locales.
2026-08-05 23:37:00 +02:00
Marc-André Bombeck
feb9d25e87
test: anchor sharing release journeys
2026-08-05 23:29:55 +02:00
Marc-André Bombeck
bd6220bbba
test: add sharing security principals
2026-08-05 23:26:42 +02:00
Marc-André Bombeck
d9e68e7ee3
test: freeze sharing authorization inventories
2026-08-05 23:24:54 +02:00
Marc-André Bombeck
e05bad0ec2
chore: refresh the sharing release foundation
2026-08-05 23:14:01 +02:00
Marc-André Bombeck
553e0b4a28
Merge commit 'd07b9249c' into release/v1.37.0
2026-08-05 23:04:39 +02:00
Marc-André Bombeck