mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
Marc-André Bombeck
e63be67b5a
Land every file the v1.42 work shares before any of it is built, so the parts built side by side never edit the same file. Schema and migrations 0379-0386: the HEALTH_CONNECT measurement source, ImportJob.kind, the air-quality columns and the per-user switch on the environment tables, sealed environment locations with nullable plaintext, managed-profile handover links, the per-type HealthKit arrival ledger, lab unit-conversion provenance, and user-defined vaccines. Every new column is annotated for the column-reader sweep. HEALTH_CONNECT reaches every exhaustive list: the source labels, the read enum (not the write allowlist), the source-priority ladder cap, now the number of sources rather than a fixed eight, and the write-path smoke test. RMSSD gets its own priority class and a 300 ms ceiling. The batch syncTrigger gains `manual`, with its label on the Apple Health card. Queues for the Health Connect import, the compaction-tombstone purge and the measurement-table maintenance are registered with stub handlers; host-metric sampling moves to every five minutes. Environment and work_mem variables reach the compose whitelist, the production example and the manifest. The proxy admits the handover link and redirects it at the edge, and the Health Connect upload bypasses the proxy body limit. The new routes answer 501 behind their final authentication and are published in the contract; backup, wipe and key rotation classify the new models and columns; the seven message bundles carry the base copy. Guards that list release-pending keys and columns fail once an entry is wired, so those lists empty themselves before the tag. Also re-anchor a login-throttle fixture to the wall clock, where its expiry is compared, and re-base the aggregate bundle cap on a measured 12 KB of new locale strings.
74 lines
3.2 KiB
TypeScript
74 lines
3.2 KiB
TypeScript
/**
|
|
* Every `User` column has a backup verdict, read from the schema rather than
|
|
* from a list somebody keeps.
|
|
*
|
|
* The account row mixes the person's choices with sign-in credentials,
|
|
* provider keys, the operator's policy for the account and the host's own
|
|
* cursors, so it cannot have one verdict the way a model does. A column added
|
|
* tomorrow has to land in `USER_COLUMN_BACKUP_CLASS` (`src/lib/export/
|
|
* backup-plan.ts`) or this fails naming it: a new preference that silently
|
|
* stays behind on a restore, or a new secret that silently rides along in
|
|
* every backup file, are the two failures this exists to stop.
|
|
*
|
|
* Mutation check: delete any key from the table and the first case goes red
|
|
* naming the column; add a `User` column to the schema without classifying it
|
|
* and the same case goes red naming that one.
|
|
*/
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import { parseWipeSchema } from "@/__tests__/helpers/wipe-schema-shape";
|
|
import { USER_COLUMN_BACKUP_CLASS } from "@/lib/export/backup-plan";
|
|
import { ACCOUNT_SETTING_COLUMNS } from "@/lib/export/account-settings-backup";
|
|
|
|
const columns = parseWipeSchema().get("User")?.scalars ?? [];
|
|
const classified = USER_COLUMN_BACKUP_CLASS as Readonly<Record<string, string>>;
|
|
|
|
describe("User column backup classification", () => {
|
|
it("classifies every User column", () => {
|
|
// A floor, so a parser that stops matching cannot pass on an empty list.
|
|
expect(columns.length).toBeGreaterThan(100);
|
|
const unclassified = columns.filter((c) => !Object.hasOwn(classified, c));
|
|
expect(
|
|
unclassified,
|
|
"these User columns have no backup verdict. Add each to " +
|
|
"USER_COLUMN_BACKUP_CLASS as SETTING, CREDENTIAL, IDENTITY or " +
|
|
"OPERATIONAL, and if it is a SETTING give it a codec in " +
|
|
"account-settings-backup.ts",
|
|
).toEqual([]);
|
|
});
|
|
|
|
it("names no column the schema no longer has", () => {
|
|
const known = new Set(columns);
|
|
expect(Object.keys(classified).filter((c) => !known.has(c))).toEqual([]);
|
|
});
|
|
|
|
it("carries exactly the columns classified as settings", () => {
|
|
expect([...ACCOUNT_SETTING_COLUMNS].sort()).toEqual(
|
|
Object.entries(classified)
|
|
.filter(([, verdict]) => verdict === "SETTING")
|
|
.map(([column]) => column)
|
|
.sort(),
|
|
);
|
|
});
|
|
|
|
// The person's own data, sealed at rest for privacy rather than a secret
|
|
// that grants anything: the insurance number, and since v1.42 the home
|
|
// location the environment module resolves weather against.
|
|
const SEALED_SETTINGS = ["insuranceNumberEncrypted", "homeLocationEncrypted"];
|
|
|
|
it("carries no credential-shaped column as a setting", () => {
|
|
const sealedSettings = ACCOUNT_SETTING_COLUMNS.filter((column) =>
|
|
/Encrypted$|Token|Secret|password|totp|oidc/i.test(column),
|
|
);
|
|
expect(sealedSettings.sort()).toEqual([...SEALED_SETTINGS].sort());
|
|
});
|
|
|
|
it("never classifies a sealed column other than the sealed settings as anything but a credential", () => {
|
|
const sealed = columns.filter(
|
|
(c) => /Encrypted$/.test(c) && !SEALED_SETTINGS.includes(c),
|
|
);
|
|
expect(sealed.length).toBeGreaterThan(20);
|
|
expect(sealed.filter((c) => classified[c] !== "CREDENTIAL")).toEqual([]);
|
|
});
|
|
});
|