mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André BombeckandMarc-André Bombeck
643e6ec3a0
* Revert "revert: roll source tree back to v1.4.0 to restore production"
This reverts commit e444a90b10.
* fix(v1.4.2): summaries.WEIGHT + medications array guards + healthcheck IPv4
Three production bugs surfaced after the v1.4.0 deploy stabilized:
1. `TypeError: undefined is not an object (evaluating 'E?.summaries.WEIGHT')`
on /dashboard and /insights for users without weight readings —
the optional chain stopped at `data` when it needed to also cover
`data.summaries`. Fixed: `data?.summaries?.WEIGHT` (one level deeper).
2. `TypeError: y?.filter is not a function` on /medications — the
medications query value was non-array (likely a stale
service-worker response from an older API shape). Replaced with
`Array.isArray(medications) ? medications : []` so the page is
immune to any future shape drift.
3. Healthcheck-induced 503 outage (already in 1.4.1 — included here
so 1.4.2 is the single coherent release). The docker-compose
healthcheck used `localhost` which busybox-wget resolves to IPv6
::1; Next.js standalone listens on IPv4 0.0.0.0 only. Pinned
to 127.0.0.1.
This release also includes everything from v1.4.1 (which never
published a clean GHCR tag): the per-section admin extraction, the
testcontainers integration suite, the Playwright + axe-core E2E
foundation, the moodLog SSRF fix, the central error-redaction in
WideEventBuilder + Glitchtip, the medical-citation drift fixes
(ESH 2023, Saint-Maurice attribution, steps source), and the docs
sync.
Co-Authored-By: Marc-André Bombeck <mbombeck@gmail.com>
35 lines
1.2 KiB
TypeScript
35 lines
1.2 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
/**
|
|
* The proxy at src/proxy.ts is the single gate enforcing auth on every
|
|
* non-public path. A regression that accidentally adds a route to
|
|
* PUBLIC_PATHS, or breaks the redirect, would expose unauthenticated
|
|
* surfaces. Verify a few representative routes round-trip to /auth/login.
|
|
*/
|
|
test.describe("proxy auth gate", () => {
|
|
for (const path of [
|
|
"/",
|
|
"/dashboard",
|
|
"/medications",
|
|
"/admin",
|
|
"/insights",
|
|
]) {
|
|
test(`${path} redirects to /auth/login when no session`, async ({
|
|
page,
|
|
}) => {
|
|
const response = await page.goto(path, { waitUntil: "domcontentloaded" });
|
|
expect(response).not.toBeNull();
|
|
// Either the proxy hands back a 307/308, or the navigation lands
|
|
// at /auth/login after redirect; both are acceptable proof.
|
|
expect(page.url()).toMatch(/\/auth\/login(\?|$)/);
|
|
});
|
|
}
|
|
|
|
test("public paths are reachable without a session", async ({ page }) => {
|
|
// /auth/login is in PUBLIC_PATHS — must be served, not bounced anywhere.
|
|
await page.goto("/auth/login");
|
|
expect(page.url()).toMatch(/\/auth\/login(\?|$)/);
|
|
await expect(page.locator("body")).toBeVisible();
|
|
});
|
|
});
|