mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Four suites, each mutation-checked against a reverted protection: - route-workout-scope: the workout row is read exactly once across a ten-turn conversation that keeps sending the id, the where clause always names userId, another user's id resolves to nothing and the chat proceeds, and the section sits inside the health-data fence. - workout-evidence: the numbers-only closure. An instruction-shaped sport_type — reachable through the restore path, which types the column as free text — folds to "other" and never reaches the block; a free-text leaf at any depth throws. - page-launch-params: an unknown ?scope= is ignored silently, and ?workout= yields to both ?c= and the fenced ?doc= path. - composite-score-anatomy-coach: every score sheet carries an opener, a scope narrowed to the composite's inputs, and auto-send. resolveLaunchState's shape assertion gains the workoutId field.
1.0 MiB
1.0 MiB