mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-15 06:52:04 +00:00
The final functional web release before the iOS native client lands.
Headline work: a streaming Apple Health `export.zip` importer for
prospective iOS-migrating accounts, a server-side aggregation cache
that collapses the three hottest dashboard reads onto in-process LRU
slots with single-flight coalescing and per-user invalidation, a
broader compliance classifier with a dedicated `early` bucket so
ahead-of-window doses count as compliant, the Coach launch surface
hoisted onto every authed page with a dashboard-hero CTA, and a
trimmer Settings shelf that folds Sources into Targets. The release
also lights up the `cache.<name>.outcome` annotation on the active
wide event so production logs carry the cache hit-ratio signal
without leaking userIds.
### Added
- **Server-side aggregation cache.** A new `ServerCache<T>` primitive
(`src/lib/cache/server-cache.ts`) extends the v1.4.33 Coach snapshot
LRU shape into a reusable per-route layer with TTL expiry,
capacity-bounded LRU eviction, single-flight read coalescing, and
per-instance hit / miss / eviction / stampede counters. Wires the
three hottest dashboard reads — `/api/analytics` (slim + default),
`/api/gamification/achievements`, `/api/medications/intake?scope=compliance`
— and bolts per-user invalidation onto every measurement / mood /
medication / workout / dashboard-widget write endpoint so the next
read paints fresh data instead of waiting out the TTL. Every cache
hit / miss surfaces on the active wide event as
`cache.<name>.outcome` + `cache.<name>.key_hash` so production logs
carry the hit-ratio signal without leaking userIds.
- **Apple Health `export.zip` import.** New endpoint
`POST /api/import/apple-health-export` (synchronous multipart
upload, asynchronous ingest via a dedicated pg-boss
`apple-health-import` worker, per-`MeasurementType` ingestion
stats). Streams the upload straight to disk so a multi-gigabyte
export never lands in V8 heap, hashes the bytes inline for
content-based idempotency, and unpacks `apple_health_export/export.xml`
with a hand-rolled ZIP central-directory walker that handles Zip64
for archives past the 4 GB barrier. The parser folds every
`<Record>`, `<Workout>`, `<Correlation>`, and `<ClinicalRecord>`
into the existing `Measurement` and `Workout` row shapes — spot
rows keyed by `HKMetadataKeyExternalUUID` (or a deterministic
`sample:<sha256>` fallback), cumulative HK types collapsed into
one `stats:<HKType>:<YYYY-MM-DD>` row per user-local day to match
the iOS daily-aggregation convention. Live per-stage progress
surfaces through `GET /api/import/apple-health-export/{jobId}/status`.
An admin variant at `POST /api/admin/import-apple-health-export`
imports on behalf of a target user (cookie-only `requireAdmin()`
gate; Bearer tokens never elevate).
- **`ImportJob` schema model + migration.** New Prisma model captures
the per-upload state machine (`queued | unpacking | parsing |
upserting | done | failed`), the content-hash for idempotency
short-circuits, and the per-`MeasurementType` ingestion counters
the status route surfaces back to the client.
- **`lastSeenByType` on `/api/analytics`.** Both the slim
(`?slice=summaries`) and default slices return a per-type
`{ lastSeenAt, daysAgo }` map. The dashboard trend tiles wire 12
mounts to a new `tileStaleDays()` helper so an "X days / weeks /
months ago" hint paints under any per-metric tile whose last
sample crosses the 7-day floor. Six locales gained additive
week / month plural keys; Polish uses the genitive-plural form
that covers every non-1 count the bucket math can produce.
- **Dashboard "Ask the coach" hero CTA.** A new pill next to the
existing "Hinzufügen" / "Add" launches the Coach drawer directly
from the dashboard hero. The `<CoachLaunchProvider>` hoisted from
the insights layout to the auth shell so the drawer is reachable
from every authed route; the floating action button stays scoped
to `/insights/**` so it cannot distract on the dashboard.
- **Shared achievements query hook.** `useAchievementsQuery()`
centralises the three previous consumers — recent-achievements
card, the `/achievements` mother page, and the unlock notifier —
onto one TanStack queryKey + cache slot so dashboard cold mount
fires the endpoint once instead of twice.
- **Typed authed Cache-Control presets.** New
`src/lib/http/cache-headers.ts` module exports
`NO_STORE_BUT_BFCACHE = "private, max-age=0, must-revalidate"`,
`SHORT_LIVED_PUBLIC`, and an `applyAuthedHeaders()` helper. The
presets land at the framework level via a `next.config.ts`
`headers()` rule that stamps the bfcache-friendly directive on
every authed HTML response, restoring Chromium bfcache eligibility
for in-app back / forward navigation.
- **`scripts/print-bundle-report.mjs`.** Restores the at-a-glance
"top client chunks by parsed size" signal Turbopack dropped from
`next build`; reads `.next/analyze/client.json` (written by
`@next/bundle-analyzer` when `pnpm analyze` runs with `ANALYZE=1`)
and prints a sorted table plus totals.
### Changed
- **Settings sidebar: "Sources" folded into "Targets & Sources".**
Per-metric threshold ranges and per-metric source priority now
share one `/settings/thresholds` page so the same metric's
threshold and device-source preference sit together instead of
one sidebar entry away. `/settings/sources` keeps a
`permanentRedirect` so external bookmarks and docs links follow
through unchanged. Section count: 11 → 10.
- **Insights tab strip: vital pills collapse under a "Vitals"
parent.** Five vital pills (HRV, Resting HR, Oxygen, Body
Temperature, Active Energy) hide behind one parent pill that
opens a popover sub-list. Parent-pill active state mirrors the
URL so spatial orientation survives the collapse; each sub-page
keeps its own URL and bookmark resolves unchanged. Strip
footprint: 14 → 10 entries when every metric has data.
- **Coolify env-var audit.** `mcp__coolify-apps01__env_vars`
inspection captured the section-1 / section-2 duplicates that
have accumulated under apps-01 since v1.3.1. Audit pinned at
`.planning/round-v1434-iwa-coolify-env-audit.md`; no env-var
deletes performed (operator action).
### Fixed
- **Compliance classifier: early intakes count as compliant.** The
classifier picked up a dedicated `early` bucket (window-start
minus three hours through window-start), the `on_time` post-window
tolerance widened from one hour to three hours, and the `late`
band sits between the new `on_time` ceiling and the configurable
`lateMinutes` knob. Heatmap consumers route the new bucket
through the compliant path; the dedicated `early` counter rides
on `DailyComplianceEntry` for downstream consumers that want to
distinguish ahead-of-window from on-window intakes.
- **Compliance heatmap fallback retired.** The v1.4.33 defensive
`looksClassifierBug` fallthrough is gone now that the underlying
classifier widening removes the every-dose-very-late mode the
fallback covered.
### Performance
- **`/api/gamification/achievements` consumer collapse.** Two of
three previous consumers shared the same TanStack queryKey
literal; the third carried a per-user discriminator so the cache
treated it as a fresh slot. Dashboard cold mount fired the
endpoint twice. Collapsing onto the shared hook trims that to a
single request; with the new server-side cache slot warm, the
duplicate-mount worst case rides single-flight coalescing.
- **GHCR build fires once per release tag.** The
`docker-publish.yml` workflow lost its `push.branches: [main]`
trigger; the `:latest` raw-tag enable rule moved onto the tag
ref so each release produces exactly one multi-arch build that
refreshes both the semver tags and the `:latest` alias.
- **NFT-trace warnings silenced.** `next.config.ts` gained an
`outputFileTracingExcludes` block that narrows the Turbopack
tracer away from the `MAXMIND_LICENSE_KEY` env-access path so
the trace-report no longer warns on every dependent route file.
### Refactor
- **Dashboard analytics consumers.** The two cards that previously
decided their own freshness copy now lean on the typed
`tileStaleDays()` helper and the additive `lastSeenByType` field
on the analytics response. Mood and BD-Zielbereich tiles keep the
default `null` because they have no underlying per-type freshness
signal.
### Accessibility
- **Dashboard hero CTA hits the WCAG 2.5.5 touch-target floor.**
The new "Ask the coach" pill carries `min-h-11` on mobile and
the matching `sm:min-h-9` desktop floor so the touch target
stays above 44 px on the Pixel 5 boundary.
- **Insights tab-strip Vitals parent reads correctly to assistive
tech.** Parent pill carries `aria-current="page"` whenever the
current URL matches one of its child vital sub-pages, plus a
`data-slot="insights-tab-strip-group"` hook for visual-regression
testing.
### Internal
- **Two e2e flake windows tightened.** `onboarding-flicker` swapped
its 12-sample 50 ms poll loop for a single Playwright
auto-retrying `toBeHidden({ timeout: 700 })` assertion so the
1-2 ms race window between the analytics-pending shell and
`useAuth().user` resolving collapses to a single retry slot.
`mobile-viewport` dropped `nav a[href]` from the touch-target
sweep (the bottom-nav owns its own WCAG spec) and gated the
44-px floor on `matchMedia('(min-width: 640px)').matches === false`
so the Pixel 5 viewport never tripped into the `sm:` tier during
WebKit render commits.
- **Server-cache observability.** Every `cached()` invocation passes
an `annotate` callback that lands two keys on the wide event:
`cache.<name>.outcome` ∈ `{ hit | miss | stampede }` and
`cache.<name>.key_hash` (non-reversible djb2 32-bit hash). Ops
can grep `cache.analytics.outcome` over any time window to
compute the hit ratio per deployment.
- **AASA followups verified.** The v1.4.33 `/.well-known/apple-app-site-association`
handler serves a direct 200 on every fronting origin; Apple's
CDN has ingested matching bodies for all three domains.
### Web freeze
v1.4.34 marks the last functional release of the web codebase before
the iOS native client launches. Subsequent v1.4.x tags carry security
fixes, dependency bumps, and hotfix-only corrections. New feature work
is paused until the iOS app clears Apple review, at which point a
v1.5.0 version-bump-only release tags the milestone. The Prisma
schema head comment and `.planning/v15-strategic-plan.md` §5
decision-log row pin the freeze trigger in-tree.
259 lines
9.6 KiB
TypeScript
259 lines
9.6 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
import { STORAGE_STATE_PATH } from "./setup/global-setup";
|
|
|
|
/**
|
|
* v1.4.15 phase-A3 fix #3 — onboarding card flicker on dashboard load.
|
|
*
|
|
* The previous version of `<GettingStartedChecklist>` rendered against a
|
|
* default-true `shouldShowChecklist` decision while `measurementCount`
|
|
* was still 0 (analytics query in flight). For a fully-onboarded user
|
|
* (`onboardingCompletedAt != null` AND `measurementCount >= 5`), the
|
|
* card briefly flashed before tanstack-query wrote the real value and
|
|
* `show` flipped to false on the next render.
|
|
*
|
|
* This spec asserts the card is NEVER visible — at any sampled instant
|
|
* during page load — when both:
|
|
* - the auth user has `onboardingCompletedAt != null`, AND
|
|
* - `/api/analytics` returns ≥5 measurements.
|
|
*
|
|
* We slow `/api/analytics` deliberately so any "render-before-data"
|
|
* race condition would be fully visible to a Playwright `isVisible()`
|
|
* probe; with the fix in place, the card stays unmounted because the
|
|
* component refuses to render until `analyticsQuery.data !== undefined`.
|
|
*/
|
|
test.describe("dashboard onboarding card flicker guard", () => {
|
|
test.use({ storageState: STORAGE_STATE_PATH });
|
|
|
|
test("complete-onboarding user never sees the card during load", async ({
|
|
page,
|
|
}) => {
|
|
// Set the seed user to onboarding-complete BEFORE navigation. The
|
|
// global setup leaves `onboardingCompletedAt` null by default so we
|
|
// intercept `/api/auth/me` and pin a non-null timestamp.
|
|
await page.route("**/api/auth/me", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: {
|
|
id: "user_e2e",
|
|
username: "e2e-tester",
|
|
email: "e2e@healthlog.test",
|
|
role: "ADMIN",
|
|
heightCm: 180,
|
|
dateOfBirth: "1990-01-01",
|
|
gender: "MALE",
|
|
timezone: "Europe/Berlin",
|
|
onboardingCompletedAt: "2025-01-01T00:00:00.000Z",
|
|
onboardingTourCompleted: true,
|
|
gravatarUrl: null,
|
|
glucoseUnit: "mg/dL",
|
|
},
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
|
|
// Slow the analytics endpoint by ~250 ms so a race-condition flash
|
|
// would be unmistakable to the visibility probes below; the fix
|
|
// works by NOT rendering until this resolves, so even with the
|
|
// delay the card stays invisible the whole time.
|
|
await page.route("**/api/analytics", async (route) => {
|
|
await new Promise((resolve) => setTimeout(resolve, 250));
|
|
await route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: {
|
|
summaries: {
|
|
// ≥5 readings → past the `measurementCount < 5` setup gate.
|
|
WEIGHT: {
|
|
latest: 80,
|
|
avg7: 80,
|
|
avg30: 80,
|
|
slope30: { slope: 0, direction: "stable" },
|
|
count: 30,
|
|
},
|
|
},
|
|
bpInTargetPct: null,
|
|
glucoseByContext: {},
|
|
},
|
|
error: null,
|
|
}),
|
|
});
|
|
});
|
|
|
|
await page.route("**/api/mood/analytics", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: { entries: [], summary: { count: 0 } },
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
// Same `/api/dashboard/widgets` stub as the incomplete-onboarding
|
|
// test below — keeps the dashboard from error-boundary-bailing
|
|
// when this query 500s in CI without a real session.
|
|
await page.route("**/api/dashboard/widgets", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: { tilesVisible: { weight: true, bp: true, pulse: true } },
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
|
|
const card = page.locator('[data-testid="onboarding-card"]');
|
|
|
|
await page.goto("/", { waitUntil: "domcontentloaded" });
|
|
|
|
// The card must stay hidden through the 250 ms analytics delay and
|
|
// the render commit that follows. Playwright's auto-retrying
|
|
// assertion re-evaluates every animation frame, so a 700 ms window
|
|
// covers the delay + buffer while keeping the intent ("user never
|
|
// sees it") explicit. The previous 50-ms poll loop had a 1-2 ms
|
|
// race window where the analytics-pending shell could paint before
|
|
// `useAuth().user` resolved `onboardingCompletedAt`; the auto-
|
|
// retrying assertion collapses that window.
|
|
await expect(card).toBeHidden({ timeout: 700 });
|
|
|
|
// After the network has settled the card is still hidden — the
|
|
// user is past the setup gate, so `shouldShowChecklist` returns
|
|
// false even with real data.
|
|
await page.waitForLoadState("networkidle");
|
|
await expect(card).toBeHidden();
|
|
});
|
|
|
|
test("incomplete-onboarding user sees the card collapsed by default", async ({
|
|
page,
|
|
}) => {
|
|
// Profile fields are missing AND `measurementCount < 5` so the
|
|
// `shouldShowChecklist` gate is true (its `stillInSetup` branch is
|
|
// satisfied by the measurement-count condition). With the fix, the
|
|
// card mounts collapsed: header + progress meter visible, full row
|
|
// list hidden until the user clicks the chevron.
|
|
//
|
|
// v1.4.22 C4 — the onboarding redirect now lives in `proxy.ts`,
|
|
// not in `<AuthShell>`. The proxy reads the `hl_onboarding` cookie
|
|
// (which the auth routes mirror from the DB). Our storageState
|
|
// belongs to a fully-onboarded user (no `hl_onboarding` cookie),
|
|
// so the proxy passes the dashboard through even when the mocked
|
|
// `/api/auth/me` reports `onboardingCompletedAt: null`. That's the
|
|
// exact case this test wants to cover — the checklist mounts
|
|
// because `measurementCount < 5` AND `onboardingCompletedAt` is
|
|
// null, but the page itself still paints.
|
|
await page.route("**/api/auth/me", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: {
|
|
id: "user_e2e",
|
|
username: "e2e-tester",
|
|
email: "e2e@healthlog.test",
|
|
role: "ADMIN",
|
|
heightCm: null,
|
|
dateOfBirth: null,
|
|
gender: null,
|
|
timezone: "Europe/Berlin",
|
|
onboardingCompletedAt: null,
|
|
// Suppress the spotlight tour overlay during this spec so
|
|
// the onboarding-card visibility probe is not occluded by
|
|
// the tour's z-200 dialog. The tour itself is exercised by
|
|
// a dedicated spec — not in scope here.
|
|
onboardingTourCompleted: true,
|
|
gravatarUrl: null,
|
|
glucoseUnit: "mg/dL",
|
|
},
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
await page.route("**/api/analytics", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: { summaries: {}, bpInTargetPct: null, glucoseByContext: {} },
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
await page.route("**/api/mood/analytics", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: { entries: [], summary: { count: 0 } },
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
await page.route("**/api/medications", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({ data: [], error: null }),
|
|
}),
|
|
);
|
|
await page.route("**/api/withings/status", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({ data: { connected: false }, error: null }),
|
|
}),
|
|
);
|
|
await page.route("**/api/notifications/preferences", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({ data: { channels: [] }, error: null }),
|
|
}),
|
|
);
|
|
// v1.4.16 Wave-C — the dashboard added `/api/dashboard/widgets`
|
|
// (A5 tile-strip persistence) since this spec was written. Without
|
|
// a stub the unauthenticated layout query 500s in CI and React
|
|
// Query's error boundary swallows the page render before
|
|
// `<GettingStartedChecklist>` can mount.
|
|
await page.route("**/api/dashboard/widgets", (route) =>
|
|
route.fulfill({
|
|
status: 200,
|
|
contentType: "application/json",
|
|
body: JSON.stringify({
|
|
data: { tilesVisible: { weight: true, bp: true, pulse: true } },
|
|
error: null,
|
|
}),
|
|
}),
|
|
);
|
|
|
|
// Make sure no localStorage carries an `expanded=1` from a previous
|
|
// session — the spec asserts the *default* is collapsed.
|
|
await page.addInitScript(() => {
|
|
try {
|
|
window.localStorage.removeItem("healthlog-getting-started-expanded");
|
|
} catch {
|
|
/* storage unavailable */
|
|
}
|
|
});
|
|
|
|
const card = page.locator('[data-testid="onboarding-card"]');
|
|
|
|
await page.goto("/", { waitUntil: "domcontentloaded" });
|
|
await page.waitForLoadState("networkidle");
|
|
|
|
await expect(card).toBeVisible({ timeout: 10_000 });
|
|
|
|
// The collapsed shell exposes the toggle as `aria-expanded=false`;
|
|
// the row list (`#getting-started-body`) is unmounted, not just
|
|
// hidden, so a `count()` query returns 0 in the collapsed state.
|
|
const toggle = card.getByRole("button", { expanded: false });
|
|
await expect(toggle).toBeVisible();
|
|
await expect(card.locator("#getting-started-body")).toHaveCount(0);
|
|
});
|
|
});
|