Marc-André Bombeck
5e8b90bcc1
Merge notification delivery identity
2026-08-06 05:12:42 +02:00
Marc-André Bombeck
f6b9c8e882
fix(02-12): fail closed in record presentation
...
- retain elevated chrome only for internally consistent payloads\n- fall back to the caller record on malformed access entries
2026-08-06 05:07:27 +02:00
Marc-André Bombeck
6c4dd2d96b
feat(02-12): route scoped records to granted domains
...
- keep shared navigation independent of actor module preferences\n- open scoped records at their first allowed destination\n- announce record access and kind in doorway names
2026-08-06 05:02:37 +02:00
Marc-André Bombeck
affd356677
test: retain sustained safety event claims
...
- exercise the shared notification claim boundary\n- preserve rolling sustained-run dedup coverage
2026-08-06 04:59:50 +02:00
Marc-André Bombeck
9eab70f032
feat(02-12): add scoped profile summary
...
- expose bounded read-only profile facts for shared records\n- keep profile navigation separate from Settings mutations
2026-08-06 04:59:25 +02:00
Marc-André Bombeck
9ba37342d7
fix: claim notification events atomically
...
- serialize rolling event claims before delivery\n- keep provider egress outside the transaction
2026-08-06 04:57:50 +02:00
Marc-André Bombeck
ba7bf49fae
test: cover atomic notification event claims
...
- race record event claims through PostgreSQL\n- require safety producers to honor the claim
2026-08-06 04:53:50 +02:00
Marc-André Bombeck
60f91d27d7
fix: validate account access payloads
...
- Share the closed access schema with OpenAPI\n- Fail closed on malformed or stale record metadata
2026-08-06 04:52:46 +02:00
Marc-André Bombeck
69f97b268c
fix: erase notification anchors with record data
...
- remove record event anchors during data deletion\n- retain sustained safety dedup coverage
2026-08-06 04:48:47 +02:00
Marc-André Bombeck
9c4c7b2b7d
fix: retain notification anchor boundaries
...
- classify local notification anchors outside backups\n- keep reminder dedup fixtures on record events
2026-08-06 04:46:45 +02:00
Marc-André Bombeck
c6b5d5df63
test: cover account access payload parsing
...
- Preserve canonical shared and manage payloads\n- Reject malformed and stale access metadata
2026-08-06 04:46:15 +02:00
Marc-André Bombeck
10a58a7e6a
test: cover recipient-scoped Telegram persistence
...
- retain independent recipient reminder slots\n- verify chat updates and recipient cascade cleanup
2026-08-06 04:44:08 +02:00
Marc-André Bombeck
027f2b4355
fix: suppress premature managed safety delivery
...
- keep direct safety notifications to ordinary self-delivery\n- move safety dedup anchors out of delivery diagnostics
2026-08-06 04:41:40 +02:00
Marc-André Bombeck
ce94f4773f
fix: reject partial notification attribution
...
- retain only complete delivery principal pairs\n- preserve legacy self-delivery records
2026-08-06 04:39:36 +02:00
Marc-André Bombeck
8b275c87db
test: cover partial notification attribution
...
- reject one-sided delivery identities\n- avoid ambiguous push-attempt ledger writes
2026-08-06 04:38:48 +02:00
Marc-André Bombeck
fa46f27b01
feat: scope Telegram reminder tracking to recipients
...
- keep delegated recipient slots independent\n- bind callback cleanup to the recipient account
2026-08-06 04:38:09 +02:00
Marc-André Bombeck
5807879439
test: cover recipient-scoped telegram reminders
...
- Keep identical slots separate for each recipient\n- Update one slot when a recipient changes chat
2026-08-06 04:33:35 +02:00
Marc-André Bombeck
9380ea0f18
feat: separate notification event anchors
...
- Store record-scoped scheduler events outside delivery attempts\n- Keep delivery diagnostics free of bookkeeping rows
2026-08-06 04:32:52 +02:00
Marc-André Bombeck
2999b75ea6
test: cover notification event anchors
...
- Require record-scoped reminder deduplication\n- Keep anchors independent of delivery recipients
2026-08-06 04:29:54 +02:00
Marc-André Bombeck
1ba73a4d51
fix: enforce notification delivery authority
...
- Require active Guardian authority before cross-record delivery\n- Serialize managed delivery checks with lifecycle changes
2026-08-06 04:29:18 +02:00
Marc-André Bombeck
ba3be7ba9b
feat: distinguish managed record access
2026-08-06 04:18:05 +02:00
Marc-André Bombeck
afae57207c
feat: scope shared record navigation
2026-08-06 04:13:59 +02:00
Marc-André Bombeck
2ccd022410
test: update notification sender attempt mocks
...
- Exercise identity-aware delivery attempt recording\n- Keep self-delivery assertions explicit
2026-08-06 04:05:33 +02:00
Marc-André Bombeck
201a24e404
Merge managed record settings
2026-08-06 04:05:16 +02:00
Marc-André Bombeck
437d916fc6
fix: guard managed setting label inventories
...
- Treat inherited property names as unavailable settings
- Preserve legacy tile aliases only for declared entries
2026-08-06 04:01:00 +02:00
Marc-André Bombeck
906118f86e
fix: resolve notification delivery identity
2026-08-06 03:57:23 +02:00
Marc-André Bombeck
6108a71d80
feat: separate notification subjects and recipients
2026-08-06 03:46:57 +02:00
Marc-André Bombeck
247ac8494c
fix: complete managed record settings
...
- Expose canonical defaults and reject invalid settings families\n- Localize Guardian controls and refresh dependent caches
2026-08-06 03:40:13 +02:00
Marc-André Bombeck
e788675b82
feat: configure managed record settings
...
- Scope writable settings to the selected managed record\n- Render typed Guardian controls with separated audit attribution
2026-08-06 03:21:02 +02:00
Marc-André Bombeck
389f2a042b
fix: complete managed Guardian invitation lifecycle
2026-08-06 03:19:34 +02:00
Marc-André Bombeck
32380b1935
fix: clear revoked Guardian sessions
...
Return a removed Guardian's browsers to their own record.
2026-08-06 03:08:51 +02:00
Marc-André Bombeck
ffe3225639
fix: complete managed Guardian lifecycle
...
Use locked Guardian membership and transactional lifecycle audits.\n\nKeep acceptance and marker changes atomic.
2026-08-06 03:05:19 +02:00
Marc-André Bombeck
523ab3220b
fix: serialize managed profile Guardians
...
Protect every Guardian-reducing lifecycle transition with a record lock.\n\nReturn a recoverable refusal when the final Guardian remains.
2026-08-06 02:50:30 +02:00
Marc-André Bombeck
03ee01ba56
feat: show managed integration status
...
- Render a record-keyed status view for managed profiles\n- Refuse shared Settings links before actor controls mount\n- Localize intentional unavailable states
2026-08-06 02:38:54 +02:00
Marc-André Bombeck
e5e3590ca3
feat: add managed profile Guardians
...
- Keep the ordinary invitation consent flow for a second Guardian\n- Clear managed Guardian expiry when the invitation is accepted
2026-08-06 02:32:59 +02:00
Marc-André Bombeck
58434a2b44
feat: create managed profiles atomically
...
- Require a fresh cookie MFA proof before creation\n- Create the credential-less profile and initial Guardian grant together
2026-08-06 02:28:56 +02:00
Marc-André Bombeck
d95c48f48d
feat: classify managed record settings
...
- Inventory every Settings destination as an explicit access class\n- Fail closed for unknown deep-link destinations
2026-08-06 02:28:29 +02:00
Marc-André Bombeck
009de7cb5f
feat: add record keyed settings
...
- Separate managed record settings from actor identity\n- Limit integration reads to the active managed record
2026-08-06 02:26:44 +02:00
Marc-André Bombeck
c3125078b9
chore: resolve sharing lint checks
...
Keep attribution and provider-work tests lint-clean.
2026-08-06 02:13:50 +02:00
Marc-André Bombeck
d404d8275a
fix: preserve import job wipe ownership
...
Keep durable actor attribution from deleting record-owned jobs.
Align provider and idempotency coverage with fail-closed behavior.
2026-08-06 02:11:01 +02:00
Marc-André Bombeck
f5ca810643
chore: format sharing authority controls
...
Apply repository formatting to provider and import coverage.
2026-08-06 02:05:24 +02:00
Marc-André Bombeck
620817b10b
fix: retain import actor attribution
...
Persist record and actor identities through job completion.\nWrite one bounded transactional completion audit per job.
2026-08-06 02:00:35 +02:00
Marc-André Bombeck
adb932052c
fix: keep managed system work operator-scoped
...
Resolve managed record credentials through the operator policy for system work.
2026-08-06 01:53:04 +02:00
Marc-André Bombeck
e209db24f4
fix: block delegated provider egress
...
Carry bounded work authority through queues and revalidate it at dispatch.\nResolve shared records without personal credentials.
2026-08-06 01:49:33 +02:00
Marc-André Bombeck
60b842f614
fix: reauthorize delegated replay
...
- Recheck the live grant before returning cached delegated responses
- Refuse cached replay when the acting record cannot be resolved safely
2026-08-06 01:29:07 +02:00
Marc-André Bombeck
d86358f3e4
fix: recover managed sharing boundaries
2026-08-06 00:19:35 +02:00
Marc-André Bombeck
4923db6464
fix: preserve account access compatibility
2026-08-05 23:58:26 +02:00
Marc-André Bombeck
e4e773d543
feat: define scoped sharing levels
2026-08-05 23:58:18 +02:00
Marc-André Bombeck
ab14fdb6f3
Let an invitation name its sections and offer management
...
An owner can now narrow a grant to the parts of their record they mean to
share, and can offer the third level. Both decisions are made once, on the
invitation, and neither widens afterwards.
The invite schema takes `scope`: absent or null is the entire record, which
is what every stored grant means and what an owner who does not narrow still
gets. An empty array, a key outside the vocabulary and the whole-record
sentinel are each refused with a 422 naming the field; `inviteGrant` refuses
the same three underneath, and its `invalid_scope` now has an HTTP mapping
instead of falling into the generic refusal.
Offering MANAGE asks for a fresh second factor when the account has one. That
gate resolves through the session cookie and has no Bearer fall-through, so a
token caller is refused first with `sharing.invite.manage_browser_only` rather
than being told it is not authenticated by a route that had just
authenticated it. The consequence is deliberate: management of a health
record is offered from a browser.
The account payload gains `sections` and `level` beside `access` and
`canWrite`, resolved server-side and ordered as the consent screen reads.
`access` was `grant.access === "WRITE" ? "write" : "read"`, which would have
published a grant that can delete entries as read-only; it is a total map
now, so the next level cannot ship silent. The capabilities hook carries both
facts and turns neither into an affordance yet — the edit and delete controls
come back in the release where the routes behind them answer.
The consent surface asks two questions in order rather than laying out a
nineteen-cell grid. The level is three radios, narrowest preselected. What
they can open is two radios, the entire record preselected, and only the
narrow branch expands the eight sections with a sentence each. Both honest
limits are stated above the checkboxes, where the decision is being made: a
section shares everything written in it, and the cross-record surfaces do not
appear for a narrowed grant. Documents carries its own warning, cycle appears
only for an owner who tracks it, and Manage collapses the question to the one
line that answers it.
The Manage sentence says the other person can add, change and remove entries,
including ones the owner entered themselves, and says in the same breath what
it does not reach. The acceptance side gets its own responsibility line rather
than the write one wearing a stronger adjective.
Six locales.
2026-08-05 23:37:00 +02:00
Marc-André Bombeck
d42d2bb784
Merge branch 'main' into release/v1.37.0
2026-08-05 23:04:36 +02:00
Marc-André Bombeck