mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
50a65b6f80
Enrol TOTP from the settings surface, sign out, sign back in through the challenge, and step up for a recovery-code rotation — in a browser, against a real server, on a throwaway account the journey seeds and drops itself. Four refusals ride alongside the four positives: a wrong code at the challenge (401, no session cookie, and the ticket's attempt counter moved), the enrolment code replayed (401, refused by the monotonic totpLastStep floor), the rotation once the session's mfaVerifiedAt has aged past the five-minute window (401 with meta.errorCode auth.stepup.required), and a recovery code presented a second time (401). Each was proved to fail by removing the control it stands on and watching that one assertion break. Codes are computed from the enrolment secret with the otpauth dependency the server verifies against, at explicit timestamps, so nothing waits on a step boundary: the sign-in code is generated one step ahead of now, inside the ±1 drift window and necessarily above the replay floor. The fixture reaches Postgres for the two things that have no endpoint by design — ageing the step-up stamp, and emptying the per-IP auth buckets this journey would otherwise exhaust. The account carries the Playwright project name so the two browser projects never drive one factor state. Adds data-testid hooks on the TOTP card, the login step, and the password form so the spec asserts on stable attributes instead of rendered text.
src/components/
React components. The UI primitives are shadcn/ui (new-york style, zinc base) over Radix + Tailwind 4 + Lucide; everything above the primitives is feature-grouped by surface. Components are server components unless they need a hook, state, or browser API, in which case they open with "use client". Charts use Recharts 3 — replacing the chart library requires explicit approval.
Primitives and shell
ui/— shadcn/ui primitives (button, dialog, sheet, table, …). Generated by the shadcn CLI; keep edits minimal and on-style.layout/— the app shell: sidebar, topbar, bottom nav.providers.tsx,version-poller.tsx— top-level context providers and the self-healing stale-shell poller.i18n/— translation context + locale switcher.
Feature groups
insights/— insight status, assessment cards, Coach surface, advisor cards (the largest group).medications/— medication cards, the schedule wizard, intake timeline, detail history.settings/— the section components behind each settings page.measurements/,mood/,dashboard/— entry forms, lists, dashboard tiles.charts/— Recharts wrappers.monitoring/— Umami / GlitchTip client bootstrap.gamification/,targets/,comparison/,doctor-report/,clinician/,onboarding/,admin/— the remaining per-surface groups.
Conventions
Kebab-case filenames; React component exports stay PascalCase regardless. (A handful of PascalCase-filename outliers under medications/ + onboarding/ are pre-existing drift, noted in ../../CLAUDE.md.) Every t() call needs a matching key in messages/en.json — guarded by i18n-call-site-coverage.test.ts. Data reads go through TanStack Query with keys from @/lib/query-keys and unwrap (await res.json()).data. Tests live in __tests__/.