3 Commits

Include renames

Author	SHA1	Message	Date
Marc-André Bombeck	7bc8e572b1	chore(openapi): resolve yaml emitter alias + register notifications/diagnostic ... The yaml@2 emitter could not stringify .meta()-tagged sub-schemas inside z.array(...) under sortMapEntries: true — alphabetic sorting moved alias references ahead of their anchor definitions, tripping verifyAliasOrder with "Unresolved alias: a1" during stringify. The fix drops sortMapEntries from both generate-openapi and check-openapi so anchors stay emitted before their aliases; output stability is preserved by upstream determinism (Zod property declaration order + single-object path table). The committed openapi.yaml is regenerated in declaration order — large diff, functionally identical. With the emitter stable, the v1.4.48 H-APNs-1 admin diagnostic endpoint now appears in docs/api/openapi.yaml alongside its component schemas: AdminDiagnosticDevice (APNs token masked to prefix + suffix), AdminDiagnosticChannel (enabled + configPresent), and AdminDiagnosticPushAttempt (reserved for the v1.4.48+ PushAttempt table).	2026-05-23 11:07:32 +02:00
Marc-André Bombeck	ca03c6099f	chore(release): v1.4.24 ... Security + accessibility hardening release. Closes the highest-priority findings from a focused security audit of the v1.4.23 release: - Bearer auth fail-closed when a route declares no scope (api-handler) - Public /api/send Umami proxy now rate-limits 120 req/min/IP - Proxy nonce generation switched to btoa(...) for Edge portability - Session-expiry delete race uses deleteMany + catch (no more 500s) - POST /api/import returns the standard apiError envelope on 422 - Runtime Docker image pins Prisma 7.8 + worker deps to minors - Notifications page renders a real load-error alert - Accessibility: switch aria-labels, htmlFor pairing, mobile admin Overview link, deep-link anchors on notification settings - Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/ sleep/steps overlay keys, TrendCard layout tolerates long labels Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244) && pnpm format:check all green.	2026-05-12 22:33:35 +02:00
Marc-André BombeckandClaude Opus 4.7	a8b233bf86	chore(deps): add zod-openapi + yaml@2 — OpenAPI generator base ... Wires the OpenAPI 3.1 generator scaffolding ahead of the iOS-touched route registrations. `zod-openapi` (samchungy variant, picked in W1 stream-3) reads Zod v4's native `.meta()` so schemas can stay in their original validation files; `yaml@2` with `sortMapEntries: true` keeps the emitted spec stable across re-runs. `pnpm openapi:generate` overwrites `docs/api/openapi.yaml` from the registry; `pnpm openapi:check` exits non-zero on drift. The legacy hand-maintained spec is preserved at `docs/api/openapi-v1422-legacy.yaml` so the iOS contract reference doesn't disappear during the incremental migration. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-11 00:56:32 +02:00