Marc-André Bombeck 9aa0a3597a fix(api): constrain client-writable sources and batch timestamps ...

Narrow the workout create schema's source to the client-writable set
(MANUAL, APPLE_HEALTH), matching the measurement write surfaces, so a
client cannot forge a server-owned source into the cross-source picker.
Apply the single-entry plausibility bound to the measurement batch
timestamps so a backdated or future-dated row can no longer slip past
the batch path. Regenerate the OpenAPI contract.

2026-07-01 23:45:08 +02:00

881 KiB

Raw Blame History