mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
6a69bad05e
GET /api/auth/passkeys was absent from the contract entirely — no path entry, no schema — while the client teams had been pointed at a published schema for it since v1.32.8. It is now registered with the shape the route actually serves: id, name, credentialDeviceType, credentialBackedUp, createdAt, and the nullable lastUsedAt that started this. The route itself is unchanged; only the record of it was missing. PasskeyInfo is deliberately separate from WebauthnMfaCredentialInfo — one lists sign-in credentials, the other second-factor security keys, and merging them would blur two surfaces that behave differently. The route test now compares the projection the route asks Prisma for against the published property set, so neither end can move without the other. `invalid_base_updated_at` existed only in route tests. It is now on all eight published endpoints that accept a `baseUpdatedAt` body token, and the field description says the thing implementers keep getting wrong: an unparseable token, `null` included, is rejected with 422 rather than falling back to the unconditional write. Omitting the key is the only way to get that write. /api/auth/me/health-score-config also returns this 422 but is not in the spec at all; publishing that route is a separate piece of work.
docs/ — internal reference + operator playbooks
The user-facing documentation lives at https://docs.healthlog.dev — that's the canonical surface for self-hosting guides, integration walkthroughs, AI-provider setup, and the doctor-report workflow.
The files in this directory are the internal operator playbooks, audit notes, and machine-readable specs that ship alongside the source:
api/— the OpenAPI 3.1 spec for the native-client subset (iOS DTO codegen target). Seeapi/README.mdfor the preview commands. Also home to the MCP-server contract:api/mcp-capabilities.md(tools, resources, prompts, write model) andapi/mcp-skills.md(building a connector / skill).ops/— backup / restore + encryption-key-rotation playbooks. These are the runbooks an operator reaches for during an incident.self-hosting/— horizontal-scaling notes (HEALTHLOG_PROCESS_TYPE=web|worker|all) and the deploy-pipeline recipe. Routine install steps stay ondocs.healthlog.dev. Includesself-hosting/mcp.md— enabling the off-by-default MCP connector and pointing Claude.ai / ChatGPT / Claude Desktop at it, andself-hosting/sso.md— OIDC SSO login: IdP setup, the identity-pinning security model,OIDC_ONLYconsequences, and the break-glass runbook. Alsoself-hosting/geolite2.md— bringing your own offline GeoLite2 databases viaGEOLITE2_DIRinstead of sending login IPs to a third-party lookup.migration/— release-by-release migration notes. Read the entry for the version you're upgrading from.audit/— per-release audit summaries archived for forensic traceability.apple-store-connect-checklist.md— the iOS submission gate.doctor-report.md— PDF generator design notes.codex-protocol-spec.md— Codex / ChatGPT OAuth protocol reverse-engineering notes.ui-guidelines.md— UI / a11y house style.
If you're a self-hoster looking to spin up an instance, start at https://docs.healthlog.dev or jump to the Quick Start in the project README.