Marc-André Bombeck 433d983e60 test(auth): pin the step-up elevation boundary and publish its contract ...

Adds the structural guard that freezes the exact route set an elevation can
unlock, plus the behavioural suite that drives each threat case against a real
Postgres: a token alone mints nothing, an elevation minted for one token is
refused for another (same account included), a second redemption fails, a
concurrent redemption lets exactly one winner through, an expired one is
refused, an elevation never reaches requireAdmin, a wrong password is throttled
and audited without saying what was wrong, and the cookie flow is untouched.

The OpenAPI registry carries both new routes and names the accepting set in
prose, so the client implements against the contract rather than against a
description of it.

2026-07-19 12:47:04 +02:00

..

achievements-expansion.test.ts

feat(achievements): worker re-evaluates new + hidden achievements on data change

2026-05-10 10:34:32 +02:00

admin-backups-audit.test.ts

fix(notifications): auto-disable channels on persistent hard rejects (410, etc.)

2026-05-09 21:00:23 +02:00

admin-backups-download.test.ts

fix(admin): /admin/users mobile layout — card-list at < md, no truncation

2026-05-09 20:46:20 +02:00

admin-backups-restore.test.ts

feat(admin): restore from backup with full data replacement + triple-confirm

2026-05-09 20:58:33 +02:00

admin-backups-upload.test.ts

fix(mobile): bump chart controls + medication primary buttons + mood list icons to 44px

2026-05-09 20:50:08 +02:00

admin-data-wipe.test.ts

chore: remove the bug-report integration

2026-06-27 20:37:35 +02:00

admin-drain-cumulative-endpoint.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

admin-host-metrics.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

admin-reset-password.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

analytics-bp-aggregate-paged.test.ts

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

analytics-health-score.test.ts

test(blood-pressure): pin the in-target headline and BP pillar to the 90-day window

2026-06-14 14:26:58 +02:00

analytics-sleep-stages.test.ts

test(integration): anchor the reconciled sleep night inside the 30-day window

2026-07-04 14:46:19 +02:00

analytics-summaries-slice.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

analytics-weekday-tz.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

apns-dispatch.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

apple-health-import-natural-key.test.ts

chore(release): v1.28.49 — Apple Health re-import survives a natural-key collision

2026-07-16 08:48:41 +02:00

apple-health-import-reconcile.test.ts

chore(release): v1.28.36 — re-importing after a failed Apple Health import actually retries

2026-07-15 22:07:25 +02:00

apple-health-import-worker-failures.test.ts

chore(release): v1.28.33 — re-importing a cumulative Apple Health export works again

2026-07-14 11:56:29 +02:00

auth-flow.test.ts

chore(db): renumber the session-token migration to 0255

2026-07-19 11:41:12 +02:00

auth-password-change.test.ts

test(auth): bind the rotated cookie through its hash after a password change

2026-07-19 11:40:56 +02:00

backfill-workout-sport.test.ts

test(migrations): seed→apply→assert harness for the workout-sport backfills

2026-07-18 02:09:33 +02:00

bearer-scope-enforcement.test.ts

test(auth): pin the fail-closed Bearer-scope contract

2026-07-19 01:07:43 +02:00

biomarker-detail.test.ts

test(labs): integration coverage for biomarker target-range and delete

2026-06-28 14:00:55 +02:00

boot-discovery-scans.test.ts

chore(release): v1.28.46 — server performance on large instances

2026-07-16 06:47:36 +02:00

bp-in-target.test.ts

test(blood-pressure): pin the in-target headline and BP pillar to the 90-day window

2026-06-14 14:26:58 +02:00

bulk-delete-source-filter.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

cache-invalidation-coverage.test.ts

style: format the cache-invalidation coverage test

2026-06-27 22:40:01 +02:00

cascade-delete.test.ts

chore: remove the bug-report integration

2026-06-27 20:37:35 +02:00

chart-overlay-prefs.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

coach-budget-reservation.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

coach-chat.test.ts

test(coach): seed the budget-refusal integration test at the user-plan cap

2026-06-26 14:17:36 +02:00

coach-conversation-documents.test.ts

feat(coach): attach multiple documents to a conversation

2026-07-16 23:32:28 +02:00

coach-conversations.test.ts

feat(coach): GET list, GET single, DELETE conversation endpoints

2026-05-10 16:11:12 +02:00

coach-feedback.test.ts

fix(coach): feedback references coach_messages, drops plaintext column

2026-05-11 02:38:17 +02:00

coach-prefs.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

consolidate-daily-mean.test.ts

feat(measurements): consolidate gait/mobility HealthKit metrics nightly

2026-06-01 19:54:26 +02:00

consolidate-legacy-steps.test.ts

fix(measurements): legacy step consolidation no longer sweeps provider daily totals

2026-07-15 22:49:07 +02:00

cycle-import-export.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

cycle-routes.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

dashboard-widgets-save.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

dense-intraday-hourly-rebuild.test.ts

feat(insights): day navigator on the intraday pulse chart; 90-day dense retention with hourly fallback

2026-07-17 14:29:07 +02:00

dense-intraday-retention.test.ts

feat(insights): day navigator on the intraday pulse chart; 90-day dense retention with hourly fallback

2026-07-17 14:29:07 +02:00

device-register.test.ts

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

doctor-report-sections.test.ts

chore(release): v1.28.34 — nutrient intake lands as quiet context (server side)

2026-07-14 13:10:47 +02:00

documents-content-index.test.ts

test(documents): pin contentIndexSource provenance through list/detail/PATCH

2026-07-08 22:05:05 +02:00

documents-vault.test.ts

fix(documents): source the condition chips from the usage endpoint

2026-07-07 14:15:40 +02:00

drain-per-sample-cumulative.test.ts

chore(release): v1.4.30

2026-05-16 12:37:55 +02:00

export-per-type.test.ts

test(export): integration test points at the new plain-segment endpoints

2026-05-10 00:11:36 +02:00

fitbit-activity-sleep-workout-sync.test.ts

test(fitbit): remap integration fixtures onto the classic Web API

2026-06-22 09:00:39 +02:00

fitbit-metrics-sync.test.ts

test(fitbit): remap integration fixtures onto the classic Web API

2026-06-22 09:00:39 +02:00

global-setup.ts

release: v1.4.2 — resurrect v1.4.1 work + bug-fix triple (#152)

2026-05-08 17:46:31 +02:00

idempotency-replay.test.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

insights-comprehensive-cache.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

insights-feedback.test.ts

feat(api): /api/insights/feedback persists thumbs with provider attribution

2026-05-10 01:30:06 +02:00

insights-provider-chain-put.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

insights-provider-chain.test.ts

fix(ci): clear the v1.25 release-branch gate failures

2026-06-28 19:23:57 +02:00

insights-status-real-text.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

intake-late-take-future-slot.test.ts

fix(medications): keep a late take off a future slot the card supplied

2026-07-07 15:55:50 +02:00

intake-scheduled-for-targeting.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

intake-slot-dedup.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

integration-status.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

mcp-write-and-range-read.test.ts

feat(mcp): expose medication schedule, integration status, and preventive-care reads

2026-06-28 02:00:37 +02:00

measurement-rollups.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurement-soft-delete.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurements-aggregate-daily.test.ts

chore(release): v1.4.29

2026-05-16 10:59:42 +02:00

measurements-batch-delete.test.ts

chore(release): v1.7.0

2026-05-31 14:36:17 +02:00

measurements-batch.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurements-sleep-list.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-administrations.test.ts

feat(fhir): add a MedicationAdministration per acted intake

2026-06-02 16:45:23 +02:00

medication-cadence-worker.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-compliance-rollup-slot.test.ts

fix(medications): converge intake writes onto existing slot rows across sources

2026-06-10 11:18:00 +02:00

medication-weekly-compliance.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medications-intake-bulk.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

mfa-login-flow.test.ts

feat(auth): branch login through a second-factor challenge

2026-06-27 19:56:30 +02:00

mock-next-headers.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

mood-entries-bulk.test.ts

test(mood): align integration fixtures with the curated default catalog

2026-06-14 11:31:52 +02:00

mood-entries-external-id.test.ts

fix(mood): honour externalId for idempotent re-import on the native entry routes

2026-06-05 03:45:04 +02:00

mood-entries-note-column.test.ts

feat(security): add second-factor schema and encrypt free-text health notes at rest

2026-06-27 19:33:10 +02:00

mood-insights-crosstab.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

mood-tag-groups.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

note-encryption-backfill.test.ts

feat(security): add second-factor schema and encrypt free-text health notes at rest

2026-06-27 19:33:10 +02:00

nutrients-batch.test.ts

chore(release): v1.28.34 — nutrient intake lands as quiet context (server side)

2026-07-14 13:10:47 +02:00

partial-unique-live-rows.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

passkey-register.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

pr-detection-end-to-end.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

queue-singleton-policy.integration.test.ts

Pin the queue policy decisions with tests

2026-07-19 02:31:45 +02:00

rate-limit.test.ts

release: v1.4.2 — resurrect v1.4.1 work + bug-fix triple (#152)

2026-05-08 17:46:31 +02:00

rollup-concurrent-recompute.test.ts

chore(release): v1.28.33 — re-importing a cumulative Apple Health export works again

2026-07-14 11:56:29 +02:00

rollup-regression-parity.integration.test.ts

fix(rollups): rebase regression x-axis to a fixed origin for exact accumulators

2026-06-26 13:24:30 +02:00

server-cache-routes.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

sessions-and-known-devices.test.ts

test(sessions): revoke by the public handle, and prove the row id is not a key

2026-07-19 12:20:25 +02:00

settings-account-delete.test.ts

chore(release): v1.4.45 — analytics 9 s perf fix + audit-marathon closure + v1.4.44 hotfix merged

2026-05-21 23:13:21 +02:00

setup.ts

fix(auth): carry a generated secret in the session cookie, not the row id

2026-07-19 11:40:56 +02:00

share-link-documents.test.ts

test(share-links): drop the unused owner binding in the ownership guard

2026-07-07 22:00:14 +02:00

source-aware-rollups.integration.test.ts

feat(rollups): collapse overlapping sources across all read paths

2026-06-04 10:05:47 +02:00

source-priority-two-axis.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

step-consolidation-repair.test.ts

fix(measurements): legacy step consolidation no longer sweeps provider daily totals

2026-07-15 22:49:07 +02:00

step-up-elevation.test.ts

test(auth): pin the step-up elevation boundary and publish its contract

2026-07-19 12:47:04 +02:00

sync-changes.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

sync-state.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

timezone-per-user.test.ts

chore(release): v1.28.35 — timestamps honor the profile timezone

2026-07-14 20:19:23 +02:00

user-avatar.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

whoop-connect-ticket.test.ts

feat(whoop): native-scheme connect redirect and Bearer connect ticket

2026-06-05 08:10:13 +02:00

withings-activity-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

withings-oauth-flow.test.ts

test(withings): expect the no-credentials connect to redirect, not 400

2026-07-18 02:30:33 +02:00

withings-oauth.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

withings-sleep-stage-composite.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

withings-sleep-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

workout-batch-create.test.ts

test(auth): pin the fail-closed Bearer-scope contract

2026-07-19 01:07:43 +02:00

workout-batch-race.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00