mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
45599c527e
Allowlisting `PUT /api/auth/profile` so the setup flow's baseline step could finish also handed every visitor the shared demo account's contact email, its display name, its full name and its insurer fields: the allowlist admits a path and a method, and every field the handler behind it writes comes with them. The justification beside the entry named three fields; the entry admitted eleven. The write is narrowed on the server, in `applyProfileUpdate`, to height, date of birth and sex while `DEMO_MODE` is set — not in the client, which is the party the allowlist exists to distrust. It happens ahead of the email conflict check, which would otherwise answer "is this address registered here?" to anybody who can open the demo. The display-name box goes read-only there, as the anamnesis card already is, so nothing accepts input it will discard. The entry's comment now lists what the handler writes and what is admitted.