mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
533400ce60
A grant has always had an access column and `inviteGrant` has always written READ into it. That was the right way to ship the first version: "this release never grants write" was a property of the file rather than a promise in a comment. Remove it deliberately now, so somebody sharing their record can offer reading or reading plus adding. The level is a required argument to `inviteGrant` and is defaulted in exactly one place, the invite schema, where an omitted field becomes READ. An older client's payload therefore stays valid and stays narrow, and the domain module never guesses a level nobody named. There is no upgrade path and that is the decision, not a gap. A grant is READ or WRITE from the moment it is offered and stays that way until somebody ends it. Widening a live one would change what the delegate agreed to without asking them again, and their consent is half of what makes a write grant legitimate. The way up is a new invitation, accepted again. The audit row and the wide event carry the level: "who was given what, and by whom" is the question that row exists to answer.
docs/ — internal reference + operator playbooks
The user-facing documentation lives at https://docs.healthlog.dev — that's the canonical surface for self-hosting guides, integration walkthroughs, AI-provider setup, and the doctor-report workflow.
The files in this directory are the internal operator playbooks, audit notes, and machine-readable specs that ship alongside the source:
api/— the OpenAPI 3.1 spec for the native-client subset (iOS DTO codegen target). Seeapi/README.mdfor the preview commands. Also home to the MCP-server contract:api/mcp-capabilities.md(tools, resources, prompts, write model) andapi/mcp-skills.md(building a connector / skill).ops/— backup / restore + encryption-key-rotation playbooks. These are the runbooks an operator reaches for during an incident.self-hosting/— horizontal-scaling notes (HEALTHLOG_PROCESS_TYPE=web|worker|all) and the deploy-pipeline recipe. Routine install steps stay ondocs.healthlog.dev. Includesself-hosting/mcp.md— enabling the off-by-default MCP connector and pointing Claude.ai / ChatGPT / Claude Desktop at it, andself-hosting/sso.md— OIDC SSO login: IdP setup, the identity-pinning security model,OIDC_ONLYconsequences, and the break-glass runbook. Alsoself-hosting/geolite2.md— bringing your own offline GeoLite2 databases viaGEOLITE2_DIRinstead of sending login IPs to a third-party lookup. Andself-hosting/account-sharing.md— letting one account on the instance open another's health record: what the person given access can and cannot reach, what revocation does and does not undo, and which trust properties of the instance are unchanged by it.migration/— release-by-release migration notes. Read the entry for the version you're upgrading from.audit/— per-release audit summaries archived for forensic traceability.apple-store-connect-checklist.md— the iOS submission gate.doctor-report.md— PDF generator design notes.codex-protocol-spec.md— Codex / ChatGPT OAuth protocol reverse-engineering notes.ui-guidelines.md— UI / a11y house style.
If you're a self-hoster looking to spin up an instance, start at https://docs.healthlog.dev or jump to the Quick Start in the project README.