mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
40c310f0ad
The enumeration guard read any query that named userId as scoped, including an orderBy tiebreak, so the nightly recovery, strain and stress score jobs grouped every account's measurements, wrote scores into frozen records and spent cap slots on them. It also looked only at findMany and groupBy under lib/jobs. The guard now reads a scope from a query's filter only (orderBy, by, distinct, select and include are dropped first), covers count, aggregate, updateMany, deleteMany and executeRaw, and walks the boot discoveries and sweeps that live beside their domain: the rollup and mood rollup discovery, the Fitbit jobs, the cumulative record rederivation, the intake slot dedup, the inventory expiry and the climb backfill. What it then found is filtered (the score cohorts through excludePendingOwners, which filters before the cap; Fitbit sync, backfill and sleep repair; coach proposal lapsing and reminder nagging; expired coach reminders; snooze clearing; inventory expiry) or says why it needn't be (retention and expiry sweeps over rows, writes scoped by id). Jobs queued before a deletion ran anyway, since handlers act on the userId they carry without asking again. The binding of every queue now completes a job whose payload names an account pending deletion without loading its handler (pending-deletion-gate). The silent medication intake push, which does not go through the dispatcher, refuses a pending account itself.