Removes the 402 / 423 spare-code branch in the natural-language
extractor; the route surfaces budget exhaustion through the standard
error envelope, so the inline comment was an unused shim. The
recapCadence single-call wrapper was already retired alongside the
empty day-detail step.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Step advance moves focus into the new step's first input so
keyboard and screen-reader users land where they need to type. The
cadence-picker rows now register clicks across the full 44 px row,
not just the radio glyph + label. The "describe it" trigger on
step 1 rises to 44 px so it clears the WCAG 2.5.5 floor the rest of
the codebase honours.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The wizard's "✨ Beschreiben" button now opens the extractor on the
production route. The overlay merges its result onto the wizard
payload; one-shot prefills clear timesOfDay so the user has to pick
the dose time explicitly.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The flat form's oneShot switch now drives the picker's allowed kinds
directly; the picker can no longer encode a contradictory shape.
Multi-schedule medications surface a confirmation when the switch
flips on, since the existing logic drops every schedule but the
first.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The progress chip now matches the path the user actually walks (5
steps for one-shot, 6 for recurring after dropping the empty "day
detail" step). The cadence picker no longer offers a one-shot radio
once the mode picker has settled on recurring. The summary line on
the final step interpolates the actual weekdays / day-of-month /
yearly date rather than reading a category label.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lets the wizard and the edit form constrain the radio list so the
one-shot kind never appears alongside a medication-level switch
that already encodes it. The unfiltered shape is preserved for
callers that don't pass the prop.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wires the v1.5 Coach-backed extractor route into the OpenAPI
registry with field descriptions covering the citation-guarded
return shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extracts the lifecycle hook into reconcileOneShotState and wires it
into POST, PUT, and DELETE on the intake event. A user who logs the
single dose then undoes the log gets the medication back; a user who
flips skipped does too. The hook is idempotent on non-one-shot
medications.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The legacy fallback now honours medication.startsOn the way every
other dispatch tier does, so a legacy-shape schedule with a future
startsOn no longer emits historical slots. Adds a MAX_CHUNKS cap on
the forward walk for defence-in-depth, surfaces RRULE parse errors
through annotate, and stops the engine from compounding the user's
UNTIL/COUNT with its own UNTIL suffix. The header doc-comment is
rewritten to reflect that the read-flip for the legacy walkers is
the v1.5.1 release, not this one.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds three Zod refines that close gaps the audit surfaced: one-shot
medications now require a startsOn, course windows refuse endsOn
before startsOn, and rolling-cadence schedules cap timesOfDay at one
entry. The wizard's reminders toggle is now part of the create
payload so the user's choice actually ships.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Six specs walk the seven-step creation wizard end-to-end via the
German label surface, one per cadence kind, with shared step helpers
behind a single API stub. Verifies the medication lands in the list
view with the right next-due chip; one-shot suppresses the chip per
the design. Also closes the missing `wizard.page.backToList` key the
host route reads on /medications/new.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Populates messages/{de,en}.json with native copy for every key the
new picker primitives, the wizard, the edit-form refactor, and the
plain-language summary consume. The remaining four locales ship the
English fallback for v1.5.0; native polish lands in a follow-up.
CadencePicker rolling-explainer key flipped to `kind.rollingExplainer`
so the i18n resolver can return both the rolling label and its
explainer (the original `kind.rolling.explainer` path collided with
the `kind.rolling` string leaf — JSON cannot host both shapes on the
same prefix). Adds the dose-unit SI tokens (mg / g / ml) to the
placeholder-allowlist in the locale-integrity guard since those
labels are intentionally identical across every locale.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds an optional Coach-backed overlay that extracts a structured
medication payload from a free-text description so the wizard can
pre-fill its steps. The route is rate-limited and budget-gated; the
prompt carries a citation-coverage guard so the extraction cannot
hallucinate a name + dose pair the user did not write.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a step-driven create flow that composes the cadence picker, the
times-of-day chips, and the course-window row. Surfaces a placeholder
slot for the natural-language extraction overlay that lands separately.
Pure helpers (validateStep, buildCreateBody, summariseCadence) carry
the test surface; the interactive flow is covered by Playwright in a
later commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drops the legacy weekday grid in favour of the cadence picker, the
times-of-day chips, and the course-window row. Pre-v1.5 medications
read-fall-back through inferCadenceFromLegacy; writes go to both
shapes so the v1.5.x dual-write window stays intact.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Annotates the medication Zod schemas with the metadata the OpenAPI
generator consumes and wires the seven medication routes into the
registry. The XOR constraint between rrule and rollingIntervalDays
is documented at the schema description so iOS code-gen surfaces the
mutual exclusion.
Routes covered: list + create on /api/medications; read + replace +
delete on /api/medications/{id}; intake log on
/api/medications/{id}/intake; cadence + compliance read on
/api/medications/{id}/cadence.
Medication is registered as a top-level component so the iOS Swift
codegen produces a shared struct backing the list and detail variants.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three components plus a shared `types.ts` module under
`src/components/medications/scheduling/`. The wizard + the form
refactor consume them; the picker emits a `CadenceValue`
discriminated union that the form maps onto the API request body.
### CadencePicker
A grouped flat radio list with 8 cadence kinds:
- Every day → `FREQ=DAILY`
- Certain weekdays (chip-toggle row) → `FREQ=WEEKLY;BYDAY=...`
- Every N weeks on certain days → `FREQ=WEEKLY;INTERVAL=N;BYDAY=...`
- Monthly on day → `FREQ=MONTHLY;BYMONTHDAY=N`
- Every N months on day → `FREQ=MONTHLY;INTERVAL=N;BYMONTHDAY=M`
- Yearly on date → `FREQ=YEARLY;BYMONTH=M;BYMONTHDAY=D`
- Rolling N days from last intake → `rollingIntervalDays: N`
- One-time dose → `oneShot: true`
The "Every N days flexible" option carries an explainer line so
the GLP-1 patient understands the rolling semantic. Defaults are
chosen so the encoded RRULE is always parseable (weekday set
defaults to Monday, yearly clamps to Jan 1) — the wizard / form
gates "continue" until the user picks the real day.
Sub-controls state is owned by the parent (the picker accepts
`subControls` + emits via the second `onChange` arg) so a wizard
that re-enters step 3 sees the user's previous picks.
### TimesOfDayChips
Multi-chip HH:mm input with morning / noon / evening / night
presets. Dedupes + sorts. `maxChips` prop honours the Zod cap of
8; when the parent passes `maxChips: 1` (one-shot context) the
component renders a single time picker instead of a chip row.
### CourseWindowRow
Two date pickers (`startsOn` + `endsOn`) with a "No end date"
toggle. `lockEndsToStart` prop forces the one-shot case where
both pickers share a date. Validation message rendered below the
row when `endsOn < startsOn`.
### Quality
- "use client" on every component file.
- shadcn/ui-only — no new deps, no shadcn Calendar primitive in
this repo so date pickers fall back to `<Input type="date">`.
- WCAG 2.5.5 tap targets (44 px) across every interactive
element; focus rings, aria-labels, aria-pressed on toggles,
role="group" on chip rows.
- 49 tests across the three components (encoder mapping, sort /
dedupe / preset toggle, range validation, SSR-only render
smoke tests). Pure helpers exported so the contract is pinned
at the unit-test level; user-event paths land in Playwright
e2e per the synthesis quality bar.
i18n keys listed at the top of each component file under
`medications.scheduling.{cadence,timesOfDay,courseWindow}.*`. The
follow-up i18n agent populates DE + EN.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Zod validators + the engine + the worker accept the new
v1.5 fields. The API route handlers didn't — they silently dropped
`startsOn` / `endsOn` / `oneShot` / `timesOfDay` / `rrule` /
`rollingIntervalDays` / `reminderGraceMinutes` before the Prisma
write. This commit threads them through.
### Route invariants
- One-shot consistency: `oneShot === true` ⇒ at most one schedule
(422 otherwise), that schedule has neither `rrule` nor
`rollingIntervalDays`, and `endsOn` is auto-normalised to equal
`startsOn` on write.
- Recurring default: when `oneShot !== true` and the incoming
schedule has no `rrule` / `rollingIntervalDays` / legacy
`daysOfWeek`, the route stamps `rrule = "FREQ=DAILY"` so the
worker always sees a clean shape.
- Backwards compat: empty / absent `timesOfDay` is server-side
populated from `windowStart` so the engine always sees a
non-empty array, and legacy iOS v0.6.x clients that still post
the `windowStart` / `windowEnd` / `daysOfWeek` shape keep
working unchanged.
### Tests
9 new cases across both route test files (7 POST + 3 PUT, one
POST as a 7b subcase): one-shot create persistence, RRULE
persistence, rollingIntervalDays persistence, one-shot +
recurrence → 422, one-shot + multiple schedules → 422, PUT
endsOn updates, legacy POST back-fills timesOfDay, legacy POST
with no recurrence hints stamps daily.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
8 cases that exercise the schedule-resolution path against a
testcontainer Postgres + the canonical recurrence engine + the
reminder worker's helper seam:
1. **Bi-weekly RRULE** — `FREQ=WEEKLY;INTERVAL=2;BYDAY=WE` anchored
on a known Wednesday emits week 1, skips week 2, emits week 3.
Pins the pre-existing worker bug closed.
2. **Monthly** — `FREQ=MONTHLY;BYMONTHDAY=1` emits 3 first-of-month
slots across a 3-month window; in-between days don't fire.
3. **Quarterly** — `FREQ=MONTHLY;INTERVAL=3;BYMONTHDAY=15` emits 3
slots across 9 months; off-quarter months don't fire.
4. **Rolling** — `rollingIntervalDays = 7`. Initial intake on day 0
targets day 7 as the next slot; an earlier intake on day 5
re-anchors to day 12, not day 14. Rolling emits only the
immediately-next slot; past rolling occurrences are historical
intake events, not predictable forward slots.
5. **One-shot lifecycle** — a take flips `medication.active` to
false; a skip leaves it true.
6. **endsOn cap** — a daily schedule with `endsOn = today + 3d`
emits 4 slots (today + day1 + day2 + day3); day 4+ skip.
7. **Legacy fallback** — a row with `rrule = null`,
`daysOfWeek = "i2;3"` behaves the same as the explicit RRULE
bi-weekly Wednesday case. Proves the engine's legacy path closes
the worker bug for pre-v1.5 rows too — covers tenants that
haven't been backfilled (defensive).
8. **One-shot skipped intake** — separate case verifying that
skipping a one-shot does NOT auto-deactivate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A "one-shot" medication is a single-administration course (flu shot,
vaccine, post-op final dose, one-time injection). The v1.5 schema
adds the `Medication.oneShot` flag; the intake route is the place
the lifecycle bottoms out.
When a one-shot's intake row is committed AND the event is an actual
take (`takenAt !== null && skipped === false`):
1. Flip `medication.active` to `false`.
2. Audit-log `medication.one_shot.completed` with the intake id and
the medication id.
3. Annotate the wide-event so operators can see one-shot completions
land cleanly.
4. Invalidate the medication-detail cache so the UI sees the new
`active: false` on the next read.
A "skipped" event on a one-shot does NOT deactivate the medication.
The patient is saying "I didn't take this dose"; the medication
stays open until the real take is logged. Pinned by a test in the
new integration suite.
The deactivation runs AFTER the existing
`recomputeMedicationComplianceForEvent` call so a rollup-recompute
failure can't block the medication-lifecycle close.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two changes that ship as one because they share a single rewrite of
the worker's schedule-resolution site:
### The bi-weekly fix
`grep intervalWeeks src/lib/jobs/reminder-worker.ts` used to return
zero hits. The worker iterated `recurrence.daysOfWeek.includes(
todayDow)` and called it good — a bi-weekly Wednesday schedule
fired EVERY Wednesday, regardless of "on" vs "off" week. The
cadence chart respected the interval; the worker did not. This is
the single line at `reminder-worker.ts:514` and it's been wrong
since `intervalWeeks` was introduced.
The fix routes the same predicate through the new canonical engine
(`src/lib/medications/scheduling/recurrence.ts`). The engine
honours INTERVAL natively for RRULE schedules and honours the
legacy `intervalWeeks > 1` arithmetic on the fallback path. Both
paths now agree with the chart.
### New cadence types
The same rewrite picks up monthly / quarterly / yearly / rolling /
one-shot for free because the engine dispatches on the
schedule's shape. The worker doesn't special-case anything — it
just asks the engine.
### Rolling needs a `lastIntakeAt`
Rolling schedules anchor next-due on the latest
`MedicationIntakeEvent.takenAt`. The worker now does a conditional
findFirst on the medication's intake stream when the schedule list
contains a rolling row. The lookup is gated on
`med.schedules.some(s => s.rollingIntervalDays !== null)` so the
calendar-cadence common case keeps its single-query hot path.
### The seam — `worker-helpers.ts`
A small module exports `buildCanonicalSchedule`, `buildRecurrenceContext`,
`scheduleEmitsInWindow`. Keeps the worker file focused on phase math
and dispatch (it's 2347 LOC; a deeper rewrite is for another release)
and gives the integration tests a clean place to exercise the
schedule-resolution path with real Postgres rows.
### Dead code retired
- `todayDow` (line 492) — replaced by the engine's per-instant check.
- `getDayOfWeekInTz` alias (line 355) — last caller was `todayDow`.
- `parseScheduleRecurrence` import — the worker no longer touches the
legacy decoder directly; the engine handles the fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A single source of truth for "does this schedule fire at this
moment?" — replaces the three duplicate engines that grew up
alongside each other (`expandScheduleSlots` in scheduling/cadence,
`getNextOccurrenceTimestamp` on the medication card,
`getNextRecurrenceDate` in the medication form). The retirement of
the three legacy walkers is a follow-up wire-up step; this commit
ships the engine standalone with no callers so the foundation can
land on its own.
### `src/lib/medications/scheduling/recurrence.ts`
Three public functions:
- `occurrencesBetween(schedule, from, to, ctx)` — emit every slot
in `[from, to]` inclusive, time-of-day applied, in chronological
order.
- `nextOccurrenceAfter(schedule, after, ctx)` — strict-after; null
when the schedule has terminated.
- `matchesInstant(schedule, instant, ctx)` — 1-minute-tolerance
predicate for the reminder-worker fan-in.
The engine dispatches on the schedule's shape:
- One-shot → emit one slot per `timesOfDay` at the course anchor.
- Rolling → next-due = `lastIntakeAt + rollingIntervalDays * day`,
fall back to `startsOn` / `createdAt` when never taken; emit only
the immediately-next slot (past rolling occurrences are historical
intake events, not predictable future slots).
- RRULE → delegate to the `rrule` library with
`dtstart = startsOn ?? createdAt` and an optional `until = endsOn`.
- Legacy fallback (rrule + rolling both null, oneShot false) →
decode the existing `daysOfWeek` string and emit weekly slots,
**now correctly honouring `intervalWeeks > 1`** — the existing
`expandTodayIntakes` skipped multi-week schedules; the engine
emits them anchored at `startsOn` / `createdAt`.
Time-of-day application uses the canonical `wallClockInTz` helper
so a `08:00` schedule fires at Berlin 06:00 / 07:00 UTC depending
on DST, and a Tokyo 08:00 schedule fires at the correct UTC instant
regardless of the host clock's zone. The DST spring-forward case
(02:30 on the transition day in Europe/Berlin) forwards to 03:30
wall-clock — matches macOS / iOS / Google Calendar behaviour.
Grace window is computed from `reminderGraceMinutes` when set,
otherwise from the legacy `windowEnd - windowStart` span, with a
60-minute default for legacy single-time windows.
DoS protection: `nextOccurrenceAfter` walks forward in 90-day
chunks with a 10-year hard cap so a broken / pathological RRULE
can't spin the worker.
### Tests
28 cases pinning the contract for every dispatch branch:
- RRULE DAILY / WEEKLY / MONTHLY / QUARTERLY / YEARLY across
multi-month windows.
- Bi-weekly Wed anchored — emits weeks 1/3/5, skips weeks 2/4/6.
Pins the pre-existing `intervalWeeks` worker bug closed for the
legacy fallback path.
- Rolling: last-intake anchor + null-intake fallback + endsOn cap.
- One-shot: emit + nextOccurrenceAfter returns null past it.
- DST spring-forward (Europe/Berlin) + cross-TZ (Asia/Tokyo).
- endsOn inclusive of full UTC day (matches `@db.Date` semantics).
- Empty `timesOfDay` falls back to `[windowStart]`.
- Grace window: explicit, legacy span, default 60 min.
### Zod validation
`scheduleSchema` extended with `timesOfDay` (HH:mm entries, max 8),
`reminderGraceMinutes` (1..1440 minutes), `rrule` (length-bounded +
regex against the RRULE properties HealthLog mints), and
`rollingIntervalDays` (1..365). A `.refine` enforces the
rrule-xor-rolling invariant at the validation layer (the DB CHECK
constraint is the second line of defence).
`createMedicationSchema` + `updateMedicationSchema` gain the
medication-level `startsOn`, `endsOn`, `oneShot` triplet.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the columns the v1.5 cadence work needs without breaking any
v1.4-era reader. Pre-existing `windowStart` / `windowEnd` /
`daysOfWeek` stay live; v1.5.x writes both legacy + new; the read
flip lands in v1.5.1 once production traffic has validated the new
fields.
### Medication
- `startsOn DATE?` — course start; anchors RRULE BYDAY / BYMONTHDAY
patterns and the rolling-interval countdown's first window. NULL
preserves the legacy implicit "from creation" anchor.
- `endsOn DATE?` — course end; reminder worker stops minting slots
past this date. NULL = chronic.
- `oneShot BOOLEAN NOT NULL DEFAULT FALSE` — single-administration
flag (flu shots, vaccines, post-op final doses). Auto-deactivates
the medication after the single intake is logged.
### MedicationSchedule
- `timesOfDay TEXT[]` — first-class HH:mm entries. Patients think
in points-in-time, not in windows; the legacy single-window
primitive misframed the mental model. Migration backfills
`[windowStart]` for every pre-v1.5 row.
- `reminderGraceMinutes INT?` — replaces the implicit
`windowEnd - windowStart` span for late-classification. NULL
falls back to the legacy math.
- `rrule TEXT?` — RFC 5545 RRULE string for calendar-anchored
cadences (every N weeks, monthly, quarterly, yearly, etc.).
- `rolling_interval_days INT?` — flexible-rolling interval counted
from the latest intake. Mutually exclusive with `rrule` via the
`medication_schedules_rrule_xor_rolling` CHECK constraint.
### Backfill
The migration walks every existing `medication_schedules` row and
derives an `rrule` + a single-entry `timesOfDay` from the legacy
encoding. Three branches:
- `days_of_week IS NULL / ""` → `FREQ=DAILY`
- `days_of_week = "1,3,5"` → `FREQ=WEEKLY;BYDAY=MO,WE,FR`
- `days_of_week = "i2;1,3,5"` → `FREQ=WEEKLY;INTERVAL=2;BYDAY=MO,WE,FR`
A `pg_temp` helper handles the HealthLog-weekday → RFC-5545-BYDAY
conversion. Anything unexpected stays NULL so the v1.5.1 reader
falls back to the legacy decoder.
Indexes:
- Partial index `medication_schedules_rolling_idx` on
`rolling_interval_days IS NOT NULL` so the reminder worker can
fan in over rolling schedules cheaply on every intake event.
Column comments document the legacy → v1.5 → v1.6 migration plan
so a future reader doesn't accidentally drop the legacy columns
before the read-flip lands.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v1.5 medication-scheduling work needs to model monthly /
quarterly / yearly cadences plus arbitrary `INTERVAL` patterns. The
existing string encoding caps the interval at 4 weeks and has no
representation for month-level recurrence at all. RFC 5545 RRULE is
the industry standard for this and the `rrule` package is the
battle-tested TypeScript implementation (used by Google Calendar
sync, EventKit translation layers, FHIR servers).
Pin the latest stable. The library's release cadence has slowed
since 2022; a future migration to `rrule-temporal` is worth tracking
once Node 24 LTS lands, but the existing surface covers HealthLog's
needs without modification.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Failed-login audit rows currently carry `ipAddress` plus `reason`
(`user_not_found_or_no_password` or `invalid_password`). The typed
identifier is deliberately omitted (H-1 contract: PII never lands
in operator artefacts) — but that leaves no anchor a future spray
detector can group on.
Recording `hashToken(identifier)` alongside the reason keeps the
H-1 contract intact (HMAC-SHA256 under `API_TOKEN_HMAC_KEY` is one-
way; the raw identifier never serialises into the row) while
giving any future "same identifier hit from many IPs" detector a
correlation key.
Test mock for `hashToken` now returns a deterministic hex string
that does not echo the raw input — mirrors the real HMAC shape
and keeps the existing "audit row must not contain the typed
email" assertion passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`POST /api/devices` returns a distinct 409 when an `apnsToken` (or
the legacy `token`) is already bound to a different account —
`apns_token_owned_by_other_user` / `token_owned_by_other_user`. The
guard is correct (an attacker who can guess an APNs token shouldn't
be able to hijack another account's pushes), but without a rate
limit the same 409 signal lets an authenticated user enumerate
token ownership across accounts unboundedly.
A `checkRateLimit("devices:register:${userId}", 20, 15 * 60 * 1000)`
landing before the schema parse caps enumeration at 20 mutations
per 15 minutes per user. Real-world clients register a device once
on login plus once on each APNs token rotation; 20 / window is well
outside any legitimate use.
The 429 returns through `apiError()` for envelope parity, and a
`devices.register.rate-limited` wide-event annotation lands so
operators can see the limit fire. Test mock adds the
`@/lib/rate-limit` arm + re-arms the success path inside
`beforeEach` because `vi.resetAllMocks()` strips the top-level
`mockResolvedValue`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`generateRegistrationOptions` and `generateAuthenticationOptions` were
both passing `userVerification: "preferred"`. The WebAuthn spec
treats `preferred` as a soft hint — an authenticator that lacks (or
chooses to skip) a UV factor returns an assertion with
`userVerified: false`, and SimpleWebAuthn accepts it as a successful
ceremony. The registration carries the same `userVerified: false`
flag forever, so a credential created without a biometric / PIN /
fingerprint check cannot reach AAL3 on any later assertion either.
Flipping both call sites to `"required"` makes the UV check
mandatory at the authenticator-policy layer. Apple's platform
authenticators (Touch ID / Face ID / passcode) and every shipped
hardware authenticator support UV, so the user-visible flow is
unchanged for every realistic device.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A single-page reference for anyone editing the repository. Pairs with
README.md (the public face) and CHANGELOG.md (the release history);
the focus here is the conventions, gotchas, and structural boundaries
that don't show up by reading any one file in isolation.
Covers:
- The voice + privacy contract for committed artefacts (no AI /
agent vocabulary, no personal names, no live health figures, no
live tenant identifiers).
- Branch and release model (main = release-only, develop = feature
target, semver-conservative).
- Tech stack at a glance with the load-bearing pins.
- A request-flow diagram that traces a request from the client edge
through proxy.ts, apiHandler, route body, the response envelope,
and back.
- Coding conventions (apiHandler everywhere, no mass assignment,
raw SQL parameter-bound or whitelist-spliced, queryKey factory,
Zod-OpenAPI registry stays in sync, …).
- The command surface for tests, typecheck, lint, OpenAPI gen,
env-check, bundle inspection.
- A critical-files map keyed to the boundaries an editor cares
about (HTTP edge, API kit, response envelope, crypto, sessions,
refresh tokens, rollup tier, AI provider chain, notification
dispatcher, OpenAPI registry, schema, compose).
- Security-relevant patterns to preserve on future churn (encryption
fail-closed, isPublicUrl as the SSRF floor, rate-limit bucket
convention, webhook secret + timingSafeEqual, idempotency scope,
strict CSP, no CORS anywhere, centralised redaction).
- Self-hosting gotchas (SESSION_COOKIE_SECURE, pull_policy: always,
encryption key rotation playbook, GeoLite2 staging, APNs .p8 key
scoping + env-var contract).
- iOS handoff specifics (stats:* externalId overwrite contract,
refresh-token rotation, requireAdmin cookie-only boundary,
clientManaged opt-in, push_attempts ledger).
- DO-NOTs (no --no-verify, no force-push to main, no destructive git
as a shortcut, no markdown library, no CORS headers, …).
- Pointers to the rest of the documentation set + the local
codebase / security audit notes under .planning/.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`enforceBudget()` catches the cost dimension — once a user has burned
the day's token allowance the route returns 429 with
`coach.budget.exceeded`. It does not catch the request-rate
dimension: a tight loop or a stolen session can issue 60 requests in
a second, all accepted up to the moment the budget arithmetic
finally rejects, while pinning Prisma connections and provider-side
SSE slots in the meantime.
A `checkRateLimit("coach-chat:${userId}", 20, 60_000)` call lands in
front of the budget gate. 20 requests per minute is well outside any
realistic interactive pace — a human doesn't type that fast and the
iOS client paces from user gestures — while keeping the budget logic
as the cost ceiling it was designed to be.
The 429 returns through `apiError()` for envelope parity with the
other rate-limited routes; an `insights.coach.rate-limited`
wide-event lands so operators can see when the limit fires.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`scripts/rotate-encryption-key.ts` enumerated columns manually and
predated three of them:
- `User.aiOpenaiKeyEncrypted` (`prisma/schema.prisma:86`, added in
v1.4.3 alongside the other AI provider keys but never threaded
into the rotation list).
- `IntegrationStatus.lastError` (`prisma/schema.prisma:1441`) — the
AES-256-GCM ciphertext of upstream error payloads from the
Withings / moodLog sync paths. Skipped on rotation, every row
stayed on whichever key wrote it.
- `CoachMessage.encryptedContent` (`prisma/schema.prisma:1983`) —
the only `Bytes` column in the encrypted set, so it needed a
Buffer round-trip rather than the standard string path. Mirrors
the `encryptToBytes` / `decryptFromBytes` pattern at
`src/lib/ai/coach/persistence.ts:60-71`.
Without these three, the documented rotation flow ends with the
operator removing `v1` from `ENCRYPTION_KEYS` while rows still live
on the legacy key — and the next read of an affected row throws,
breaking AI Settings, the integration-status panel, or the Coach
history page depending on which column was missed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`safeJson()` previously called `request.json()` directly, which buffers
the entire body before parsing. Next.js imposes a runtime cap of around
4 MB on App Router handlers, so the worst case is bounded — but
routes that legitimately accept large batches can't tighten the cap
through the helper, and a 3.9 MB payload to a single-record route
still lands in heap before any Zod check fires.
The new `opts.maxBytes` parameter routes the request through
`request.text()`, checks the byte length first, and only then runs
`JSON.parse`. A 413 envelope returns when the cap trips. Existing
callers (every route that doesn't pass `opts`) keep their current
behaviour — the helper falls through to `request.json()` exactly as
before, no regression risk on the broader codebase.
The CSP-report endpoint inlines the same pattern with a 10 KB cap;
this generalises it so single-record routes can pass `{ maxBytes:
16_384 }` and batch routes can pass `{ maxBytes: 262_144 }` (or
whatever fits the schema's max array length × per-row budget).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`readMoodLogSecret()` previously caught every decrypt failure and
returned the stored bytes verbatim, on the theory that legacy
plaintext rows should keep working through the migration grace
period. That fallback is correct for genuinely unprefixed legacy
values, but it also swallowed two failure modes that should never
silently succeed:
- An envelope-shaped row (`<keyId>.<payload>`) whose key id is no
longer in the live `ENCRYPTION_KEYS` map. Returning the literal
`v1.<base64-ciphertext>` as if it were the plaintext secret would
cause every webhook attempt against that row to compare a known-bad
literal — and worse, lock the user into a state where rotating the
key out of the env quietly broke their integration.
- A row whose envelope bytes were tampered with directly in the
column (SQL injection, restored-from-backup-with-tamper, leaked DB
credentials). The catch-all returned the attacker-chosen value as
the active secret; the webhook would then accept whatever the
attacker sent over the wire.
The fix routes the envelope-shape check through `extractKeyId()` and
only catches the failure for the genuinely legacy path. Envelope
rows that fail to decrypt now throw — operators see the rotation gap
or the tampered row instead of running on a quietly-broken secret.
`isLegacyPlaintext()` simplifies to the same shape check: anything
with an envelope prefix is encrypted (even if currently undecryptable),
so it should not be re-rotated as if it were plaintext.
Two new test cases pin the contract for envelope-shape failures
(unknown key id; tampered ciphertext under a known key).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The hand-rolled extractor called `inflateRawSync(compressed)` without
a `maxOutputLength` option and never inspected the central directory's
advertised uncompressed size, so a 1 KB ZIP could expand to tens of
gigabytes during inflate and OOM the shared Next.js process. The route
already caps the upload at 1.5 GB and rate-limits to 3 / min per user,
but a single successful inflate would still take the whole container
with it.
Two layers of defence land here:
- Pre-flight refusal on the central directory's `uncompressedSize`
when it exceeds 8 GiB or when the advertised compression ratio
exceeds 200×. This is a coarse signal — the metadata is attacker-
controlled — but it catches honest-but-oversized payloads early.
- `inflateRawSync(compressed, { maxOutputLength: 8 GiB })` instructs
`node:zlib` to throw rather than expand past the cap, which holds
even when the metadata lies about the uncompressed size.
8 GiB leaves a wide ceiling for legitimate multi-year heavy-user
exports (the largest real-world ones settle in the low single-digit
GB range), while making the bomb class infeasible.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Both fields are admin-supplied and feed into outbound server-side
fetches: the Umami script URL is proxied through
`/api/monitoring/umami-script` (and the script body is re-served from
the app origin under a strict CSP), and the GlitchTip DSN derives the
`envelopeUrl` / `storeUrl` the server posts errors to. The previous
validators only checked the protocol, so an admin (or an attacker
holding the admin account) could point either at a private-IP target
and drive the server into the RFC1918 / loopback / metadata space.
The `isPublicUrl` helper already governs every other admin-supplied
outbound URL the app dials; this aligns Umami + GlitchTip with that
posture. GlitchTip DSNs carry the public key in userinfo
(`https://<key>@host/projectid`) — the WHATWG URL parser strips the
userinfo from the hostname, so the helper validates the host as
expected.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`/api/send` is the public Umami proxy. The hand-rolled allowlist it
carried predated the central `isPublicUrl` helper in
`src/lib/validations/notifications.ts` and was missing every
notation-bypass class the helper catches:
- 100.64.0.0/10 CGNAT
- 0.0.0.0/8 (only the literal `0.0.0.0` was matched)
- 169.254/16 outside the AWS metadata IP (e.g. azure metadata is
`169.254.169.254` too, but other addresses in the block are
routable to other internal endpoints)
- IPv6 ULA (`fc00::/7`)
- IPv4-mapped IPv6 (`::ffff:127.0.0.1`)
- Leading-zero IPv4 octal bypass (`http://010.0.0.1` → 8.0.0.1)
- Hex IPv4 (`http://0x7f.0.0.1`)
- Pure-decimal IPv4 (`http://2130706433`)
The dev-mode escape hatch is also dropped — serving the proxy against
a localhost / RFC1918 Umami target was never a useful configuration
anyway, since the proxy sends the visitor's user-agent + body upstream
which only makes sense against an externally-reachable analytics host.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The OpenAI, Anthropic, and local OpenAI-compatible clients all used a
bare `fetch()` with no `signal`. A tar-pit upstream (a misconfigured
local Ollama on a stalled GPU, a flaky proxy in front of a hosted
provider, or a deliberately malicious user-configured LOCAL endpoint)
could accept the POST and then hang indefinitely, pinning the request
handler until the connection died on the socket level.
A 60 s ceiling lands well outside any legitimate completion budget
(production timings live in `getEvent()?.addExternalCall` traces) while
capping the worst case.
The Codex client uses an SSE stream with its own loop and stays as-is
for now; a follow-up can thread the same ceiling through the streaming
read once the contract there is settled.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The wide-event `received_shape_excerpt` surface walks every body key
through `SENSITIVE_KEY_PATTERNS` before the eventual JSON.stringify.
The original set covered passwords, tokens, secrets, API keys, the
Authorization header, CSRF state, and nonces. Four additions worth
keeping out of observability sinks:
- `/passphrase/i` — backup-encryption passphrases (off-host backups
use one) and any future user-facing recovery-phrase flows.
- `/otp/i` — TOTP / email-OTP one-time codes for future second-factor
surfaces.
- `/recovery/i` — passkey-recovery codes and account-recovery flows.
- `/dsn/i` — Glitchtip / Sentry-style DSNs are `https://<key>@host`
shapes where the key is auth material; today they enter the system
via admin settings but a future debug surface might quote one back
in a body excerpt.
Test pins the four new patterns alongside the existing required set,
and a positive-redaction case covers all four in one shot.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three additions to the production header set in `src/proxy.ts`:
- `Cross-Origin-Opener-Policy: same-origin` isolates the
BrowsingContextGroup from cross-origin popups. Closes the
`window.opener` reference channel for Spectre-class side-channel
attacks. The OAuth flows (Withings, Codex) are top-level redirects
rather than popups, so they aren't affected.
- `Cross-Origin-Resource-Policy: same-origin` narrows the page's
resources to same-origin loaders, complementing the existing
`frame-ancestors 'none'` CSP rule for non-document subresources.
- `X-Permitted-Cross-Domain-Policies: none` shuts the Flash / Adobe
Reader `crossdomain.xml` channel that some scanners still flag.
All three land in every response; production-only HSTS stays in its
existing `!isDev` block. No CSP changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
BuildKit walks the working tree (not the git index), so files like a
local `.env`, `.planning/`, `coverage/`, the e2e Playwright
`storageState.json`, captured HARs, and `.git/` history were all shipped
into the build cache by default. The runner stage doesn't COPY any of
them into the final image, but they sit in the builder layer cache and
leak through any operation that reads cache layers (e.g. `docker save`).
The list mirrors `.gitignore` for the entries that matter, plus the
scratch directories that live in the working tree but aren't version
controlled. `.env.example` and `.env.production.example` stay explicitly
allowed so the documented self-host bootstrap keeps working.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mirrors the existing v14*-/QA-/round- patterns. Local audit and survey
artefacts written under `.planning/marathon-*`, `.planning/security-audit-*`,
`.planning/session-*`, and any future v15-stream scratch never need to
leave the working tree.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
v1.5.1 added SESSION_COOKIE_SECURE env-var opt-out but the bundled
docker-compose.yml's environment whitelist didn't forward the variable
into the container. Setting it in .env was a silent no-op for the
running Node process. One-line addition closes the gap; default
behaviour unchanged.
v1.5.1 patch. Fixes the silent login failure self-hosters hit on
plain-HTTP origins that aren't localhost — the bundled Docker image
runs NODE_ENV=production, so every cookie carried Secure, and modern
browsers drop those on http://10.x.x.x style origins. The session
cookie never made it back to the browser, /api/auth/me returned 401,
and the login page reloaded.
New SESSION_COOKIE_SECURE env var with three values:
- unset (default) — flag follows NODE_ENV === "production" (unchanged)
- "false" — never set (LAN / VPN / Tailscale-only opt-out)
- "true" — always set (pnpm dev fronted by HTTPS)
Shared helper at src/lib/auth/secure-cookie.ts replaces four scattered
literals across session, codex device-start, and withings connect.
Six unit cases pin the decision matrix.
OpenAPI spec generator now reads info.version from package.json so
the drift gate stays meaningful instead of catching every release bump.
Default behaviour unchanged for HTTPS-fronted deployments.
Verified the README's concrete claims against the codebase and fixed
every mismatch found, then surfaced features the codebase delivers
that the README was burying.
Accuracy fixes:
- Reference-range citation `ESC/ESH 2018` → `ESH 2023`. The 2023
guideline withdrew the joint ESC/ESH framing; medical-citations
module already used the 2023 variant.
- Prisma model count `26 models` → `47 models`.
- Route file count `100+` → `180+` in the architecture overview.
- Achievement count `38+` → `30+` to match the actual array length.
- Translation key count `1500+` → `2500+` per locale.
- Off-host backup cadence `weekly` → `daily` in two places. The
cron + .env.example were always daily; the README had drifted.
- API reference table corrected:
• `/api/auth/codex/authorize` → split into the three real children
`device-start`, `device-poll`, `disconnect`.
• `/api/monitoring/{glitchtip,umami}/test` → moved to the admin
section under their actual `/api/admin/monitoring/*-test` paths.
• `/api/auth/refresh/revoke` collapsed — refresh + revoke share
one route (POST body opts in).
- Removed the README pointer to `docs/audit/` since that directory
is no longer in the public docs surface.
Strength surfacing:
- Notification fan-out brag now mentions APNs as the fourth channel
(the iOS native client's delivery surface).
- AI Coach provider list now includes ChatGPT via Codex device-OAuth
(no API key needed) alongside OpenAI / Anthropic / local.
- New `Sub-second dashboard` feature bullet describes the persistent
rollup tier.
- Medication Compliance bullet now calls out the day-of-week +
`intervalWeeks` cadence support (so once-weekly GLP-1 injections
score honestly) plus the pen-inventory + side-effect tracking
surfaces.
- Security section now lists key versioning + zero-downtime rotation
CLI as a first-class control, plus offline MaxMind GeoLite2 geo
resolution and wide-event structured logging.
- Tech-stack table now flags APNs alongside the other notification
channels.
- /docs/audit/ moved out of the public docs surface (23 per-release
forensic notes). They were linked from the README but read as
internal traceability artefacts, not user-facing documentation.
Kept local for cross-release lookup; added to .gitignore so new
ones don't re-track.
- /docs/api/openapi-v1422-legacy.yaml removed — superseded by the
current openapi.yaml on the v1.5 line.
- /docs/api/openapi.yaml info.version bumped 1.4.23 → 1.5.0 so the
spec matches package.json (the doc claims the version is mirrored
from the package; previously the mirror had drifted six versions).
- /docs/ops/deploy.md: image name corrected from
`ghcr.io/marc-bombeck/healthlog` → `ghcr.io/mbombeck/healthlog`
(the previous command would have 404'd at GHCR); release-process
framing dropped from a release-pair note.
- /docs/ops/backup-restore.md + /docs/self-hosting/scaling.md:
trailing phase tags (`v1.4 G1`, `v1.4 G3`, `v1.4.40 W-POOL`)
stripped from section headers + body. Replaced an internal-notes
pointer with a concrete `getPoolMax()` reference.
The README pointer to /docs/audit/ is removed in the next commit
along with the rest of the README accuracy pass.
Strips the wave-numbering bullet prefixes (`**W0** / **W1** / ...`),
inline phase/wave parentheticals (`(W3)`, `(M6a)`), and audit-process
framing (`audit-marathon`, `Round-1 reviewer axes`, `Critical+High
closure`) from the changelog while preserving every feature description,
file reference, migration number, performance figure, and architectural
reason. The file reads like a maintainer summary now instead of an
audit-pipeline dump; the technical content is unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The .planning/ directory accumulated 485 per-release scratch files
(phase reports, QA findings, ad-hoc backlogs) across the v1.4.x line.
These were useful during the immediate work but aren't load-bearing
for anyone outside that window — they crowd the repo tree and clog
git grep results. Untracking keeps them local for active sessions
without removing them from git history.
The curated planning docs stay tracked: PROJECT.md, ROADMAP.md,
STATE.md, ios-coord/V054-server-apns-mood-report.md, the v15-* release
planning set, the sb-* architectural notes, the research/ deep-dives,
and the in-flight feature briefs.
.gitignore patterns added so future scratch files land outside the
repo from the start:
/.planning/phase-*
/.planning/QA-*
/.planning/round-*
/.planning/v14*-*
/.planning/V0*-*
/.planning/ios-coord/V*-QA-*
/.planning/research/v14*-*
/docs/ios/ (in-flight spec drafts)
The shields.io release badge inherits Cloudflare's default 5-minute edge
cache, and GitHub Camo proxies on top of that with another 5-minute TTL
— so a fresh tag (v1.5.0) can sit 10 minutes behind on the rendered
README. Adding `cacheSeconds=60` does two things at once: it creates a
new Camo hash for an immediate fresh fetch, and it pins the future
TTL at 60s so the next tag-push propagates to the badge within a
minute instead of a quarter-hour.
v1.5.0 cut. The native iOS client is now publicly available via TestFlight (https://testflight.apple.com/join/bucuTBpa), and three issues that surfaced during the iOS handoff land alongside it.
## Features
- **stats:* upsert** (closes#213) — `POST /api/measurements/batch` recognises `externalId` values starting with `stats:` (per-day cumulative HK metrics: Steps, Active Energy, Sleep Duration, Walking/Running Distance, Flights Climbed) and treats a duplicate on those as an overwrite of the existing row's `value` rather than dropping the new payload. Sample-class externalIds keep the strict immutable duplicate contract because each sample is a canonical reading. New per-entry status `"updated"` on the response envelope, new `measurement.batch.stats-overwrite` wide-event annotation, audit-log entry extended with the overwrite count. Three integration tests pin the contract.
## Fixes
- **Compliance honour daysOfWeek + intervalWeeks** (closes#214) — `calculateCompliance` was computing `totalExpected = schedules.length * days`, silently ignoring `MedicationSchedule.daysOfWeek` and `intervalWeeks`. Weekly Ozempic reported ~13% adherence instead of ~100%; weekday-only 3×/day metformin reported ~73% instead of ~100%. Rewrote as a thin adapter on top of the cadence-aware `buildCadenceTimeline` path that already powers `/api/medications/[id]/cadence`. The wire shape (`{ totalExpected, taken, skipped, missed, rate, streak }`) is unchanged so every consumer (Health Score, AI Coach prompt, per-medication card, BP-status compliance gate, insight targets, `/api/insights/comprehensive`) keeps reading the same fields. Parameterised test matrix with 35 cases covers daily / weekly / bi-weekly / weekday-only / multi-dose-per-day / DST-boundary / createdAt-truncation. Health-Score regression test pinned.
## Tests
- 8 stale integration assertions retired across `withings-oauth.test.ts`, `withings-oauth-flow.test.ts`, `analytics-bp-aggregate-paged.test.ts`, `analytics-sleep-stages.test.ts`, `apns-dispatch.test.ts` — drift from the v1.4.47.x OAuth fine-grained reason tags, the v1.4.47.2 ES256 PEM verify guard, and the v1.4.49.1 analytics slim-slice annotation rename. Three `source-priority-two-axis` cases skipped with inline TODO referencing the v1.4.49.1 commit and the relocation candidate.
- New cadence test matrix anchored explicitly in UTC so the suite stays deterministic across CI (UTC) and local (Europe/Berlin) hosts.
## Docs
- README rewrite for the v1.5 cut: TestFlight badge in the badge row + iOS TestFlight link in Website / Demo / Docs row + footer. Buy Me A Coffee badge added. Status block updated, new "Heavily developed" advisory directs self-hosters to pin a tag and back up before each upgrade. Tech-Stack flags the iOS app as TestFlight-available. Roadmap promotes v1.5 from "in active development" to "current". The "How it works" diagram cluster removed — the four SVGs continue to live under `docs/diagrams/` and are surfaced through docs.healthlog.dev where they render reliably across themes.
## Final verify
- typecheck clean
- lint clean (one pre-existing warning in `withings/resume/__tests__`)
- pnpm test: 5285 passed / 1 skipped
- pnpm test:integration: 253 passed / 3 skipped
- GHA CI on PR: build amd64 + build arm64 + lint/typecheck/test + integration + e2e + dependency audit + secret scanning + dead-code gate + env check → all green
