mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André BombeckandClaude Opus 4.7
1757b35327
Failed-login audit rows currently carry `ipAddress` plus `reason` (`user_not_found_or_no_password` or `invalid_password`). The typed identifier is deliberately omitted (H-1 contract: PII never lands in operator artefacts) — but that leaves no anchor a future spray detector can group on. Recording `hashToken(identifier)` alongside the reason keeps the H-1 contract intact (HMAC-SHA256 under `API_TOKEN_HMAC_KEY` is one- way; the raw identifier never serialises into the row) while giving any future "same identifier hit from many IPs" detector a correlation key. Test mock for `hashToken` now returns a deterministic hex string that does not echo the raw input — mirrors the real HMAC shape and keeps the existing "audit row must not contain the typed email" assertion passing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>