mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
154449d77a
A server-prefetching page dehydrates a health record into the HTML and seeds it into the client's query cache under the key the client cell reads. That copy is only right when the account the page read is the account the client's route would answer with, and under an account switch it never is: `getSession()` answers who is CALLING, deliberately and permanently, so all five prefetching pages seeded the delegate's own rows into a document opened on somebody else's record. The dashboard was the worst of it — snapshot, digest and widget layout ride routes that refuse the refetch, so the delegate's numbers stayed on the owner's dashboard, while the chart row refetched to the owner and left the page showing two people at once under a banner naming one. Resolve the session through `getUnswitchedSession()` instead, which answers null while the browser is acting on another record. The prefetch steps aside and every cell fetches through its route, which is where the grant check lives. Resolving the owner here instead was the other candidate and is worse: the grant check has exactly one home, half of what these pages prefetch rides routes that declared themselves not delegable, and re-deriving it in an RSC would be a second program deciding whose record this is. Close the two shell-level doors beside it. The Coach launcher, its drawer mount and the module tour hang off `<AuthShell>` rather than off a route, so dropping Insights and Coach from the navigation under a switch left them painting on every page in the record and on the unavailable panel too — one tap from a drawer whose every action refuses, and a `POST /api/insights/coach/seen` fired by opening it at all. All three bind `useRecordCapabilities()`, the same resolved grant the banner and the switcher read. Absent, not disabled. The prefetch rule is structural: the guard walks the app tree, so a sixth prefetching page is covered the moment it lands rather than the moment somebody remembers. The pages stay on the session-surface allowlist with their reasons rewritten, because a wrapper one directory deeper is the easiest way for a surface to walk out of a guard.
src/
Application source. HealthLog is a Next.js 16 App Router project (output: "standalone", React 19, TypeScript strict). The path alias @/* resolves to this directory. Everything a request touches lives under here; the layout below follows the request flow rather than alphabetical order.
Request flow
client → src/proxy.ts → src/app/<route>/route.ts → src/lib/api-handler.ts → handler body → src/lib/api-response.ts → client
proxy.ts— the HTTP edge (Next.js 16's renamedmiddleware). Public-path allowlist, demo-mode mutation block, server-side onboarding redirect, worker-only refusal,x-request-id+ CSP nonce generation, every security header.app/— App Router pages (RSC by default) and API routes. Every API route wraps its handler inapiHandler. Seeapp/README.md.lib/— the server/runtime toolkit:apiHandler, auth, crypto, rollups, AI, notifications, pg-boss jobs, integrations, rate limiting. Seelib/README.md.components/— React components (shadcn/ui new-york, kebab-case files). Seecomponents/README.md.
Other directories
hooks/— shared React hooks (use-prefix, kebab-case).types/— shared TypeScript declarations.generated/prisma/— the generated Prisma client (do not edit; regenerated byprisma generate). Imported as@/generated/prisma.instrumentation.ts— Next.js startup hook; boots the pg-boss worker registry and boot-time backfill queues.__tests__/— cross-cutting unit tests; most tests live in__tests__/folders next to the code they cover.
Conventions
See ../CLAUDE.md for the full set. The load-bearing ones: RSC by default ("use client" only when a hook/state/browser API needs it); every API route wraps apiHandler and parses its body with Zod safeParse; userId is always narrowed from session or Bearer, never accepted as a body field; TanStack Query keys come only from src/lib/query-keys/; outbound HTTP goes through src/lib/safe-fetch.ts.