Marc-André Bombeck 2c3eeee39b fix(consent): enforce artefact 64 KB cap via Buffer.byteLength (not char-count) ...

`z.string().max()` counts JavaScript string units (UTF-16 code
units), not bytes. The audit-table guarantee for SB-10 consent
artefacts is byte-bounded — a UTF-8 artefact full of multi-byte code
points (CJK, emoji) would otherwise slip past the 64 KB row budget.
Replace the `.max()` with a `.refine()` that uses
`Buffer.byteLength(value, "utf8")`.

Closes security M1 from the v1.4.40 QA round.

2026-05-21 12:43:28 +02:00

..

__tests__

fix(measurements): refine drill-down limit to 1000 in the validator

2026-05-17 17:18:11 +02:00

admin.ts

feat(settings): add 6 assistant-surface feature flags to AppSettings

2026-05-16 13:38:49 +02:00

auth.ts

feat(auth): signup captures browser-detected timezone

2026-05-14 12:09:16 +02:00

backup.ts

fix(validation): moodEntry.tags must parse as JSON string-array (v1.4.15 H2)

2026-05-10 00:27:20 +02:00

coach-prefs.ts

feat(coach): medications + anthropometrics exclusion toggles

2026-05-17 12:25:30 +02:00

consent.ts

fix(consent): enforce artefact 64 KB cap via Buffer.byteLength (not char-count)

2026-05-21 12:43:28 +02:00

doctor-report-prefs.ts

feat(schema): User.doctorReportPrefsJson + migration 0045

2026-05-14 13:19:17 +02:00

feedback.ts

chore(style): repo-wide prettier sweep before v1.4.6 tag

2026-05-09 02:27:17 +02:00

measurement.ts

fix(measurements): refine drill-down limit to 1000 in the validator

2026-05-17 17:18:11 +02:00

medication.ts

style(medications): prettier sweep on the W3 intake-history fix

2026-05-17 14:15:41 +02:00

moodlog.ts

feat(mood): add a first-class note column replacing the tag-based workaround

2026-05-16 12:08:53 +02:00

notifications.ts

audit(v1.3.3): SpO2 + body-composition + 14 CRITICAL/HIGH security/correctness fixes (#121)

2026-05-08 01:05:56 +02:00

phase-config.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

recommendation-feedback.ts

feat(api): /api/insights/feedback persists thumbs with provider attribution

2026-05-10 01:30:06 +02:00

source-priority.ts

chore(lib): derive metricPriorityObjectSchema from SOURCE_PRIORITY_METRIC_KEYS

2026-05-15 17:40:49 +02:00

telegram.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

thresholds.ts

chore(style): repo-wide prettier sweep before v1.4.6 tag

2026-05-09 02:27:17 +02:00

withings.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

workout.ts

fix(workout): reject endedAt <= startedAt + zero-duration PR guard

2026-05-14 22:27:32 +02:00