Marc-André Bombeck 10f9a83356 feat(sharing): open the sleep, nutrient, illness and workout reads ...

Eight routes: the two sleep reads, the nutrient overview and its daily
series, the illness episode list, detail and day logs, and the workout list.

The illness day-log read is the one worth reading twice. Its queries are
episode-scoped rather than user-scoped, and what makes them safe is the
`loadOwnedEpisode(id, user.id)` hop above them. That hop now resolves against
the record, so a delegate cannot reach their own episode from inside somebody
else's account — asserted, because it is the kind of thing that would look
fine and behave wrong.

`GET /api/workouts/[id]` stays refused. It differs from the list beside it by
one conditional include that decrypts a paragraph written about the owner.

2026-08-02 16:52:59 +02:00

..

integration

feat(sharing): open the sleep, nutrient, illness and workout reads

2026-08-02 16:52:59 +02:00