mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André Bombeck
ca03c6099f
Security + accessibility hardening release. Closes the highest-priority findings from a focused security audit of the v1.4.23 release: - Bearer auth fail-closed when a route declares no scope (api-handler) - Public /api/send Umami proxy now rate-limits 120 req/min/IP - Proxy nonce generation switched to btoa(...) for Edge portability - Session-expiry delete race uses deleteMany + catch (no more 500s) - POST /api/import returns the standard apiError envelope on 422 - Runtime Docker image pins Prisma 7.8 + worker deps to minors - Notifications page renders a real load-error alert - Accessibility: switch aria-labels, htmlFor pairing, mobile admin Overview link, deep-link anchors on notification settings - Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/ sleep/steps overlay keys, TrendCard layout tolerates long labels Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244) && pnpm format:check all green.
35 lines
1.2 KiB
TypeScript
35 lines
1.2 KiB
TypeScript
#!/usr/bin/env tsx
|
|
/**
|
|
* Emit `docs/api/openapi.yaml` from the registered Zod schemas + route
|
|
* table in `src/lib/openapi/registry.ts`.
|
|
*
|
|
* v1.4.23 baseline: only the iOS-touched routes are registered (see
|
|
* `src/lib/openapi/routes.ts`). The CI step that wraps this script runs
|
|
* with `continue-on-error: true` until the registry catches up with the
|
|
* rest of the hand-maintained `docs/api/openapi.yaml` — once coverage is
|
|
* complete, the gate flips to hard-fail in v1.4.24+.
|
|
*
|
|
* The output is stable across re-runs: `yaml@2` is configured with
|
|
* `sortMapEntries: true` so map keys land in lexicographic order
|
|
* regardless of Node version or the order in which schemas were
|
|
* imported.
|
|
*/
|
|
import { writeFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
import { stringify } from "yaml";
|
|
import { buildOpenApiDocument } from "../src/lib/openapi/registry";
|
|
|
|
const SPEC_PATH = resolve(__dirname, "..", "docs", "api", "openapi.yaml");
|
|
|
|
function main(): void {
|
|
const document = buildOpenApiDocument();
|
|
const yaml = stringify(document, {
|
|
sortMapEntries: true,
|
|
lineWidth: 120,
|
|
});
|
|
writeFileSync(SPEC_PATH, yaml, "utf8");
|
|
console.log(`Wrote ${SPEC_PATH} (${yaml.length} bytes)`);
|
|
}
|
|
|
|
main();
|