mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
350294670d
The edge01 demo refresh copied `password_hash` straight from the source account, and the README beside it asserted "demo login works". That only held while the source account happened to use the password the project publishes. The source is the operator's own instance, so the moment that password was rotated the demo started rejecting the credentials the README hands to every visitor, and nothing anywhere noticed. Someone eventually filed it as a bug (#805) after being locked out of the shop window. The load now hands the row an explicit password: the same Argon2id literal the seed script writes, applied right after the copy, then read back and compared byte for byte. A mismatch aborts the run rather than waiting for a stranger to discover it at a login screen. The statement goes in on psql's stdin. Interpolating it into the ssh command string would let the remote shell expand the hash's `$argon2id`, `$v`, `$m`, `$t` and `$p` segments to empty strings and store something no password can ever match, which is the same outage wearing a different hat. A guard test pins that too, alongside pinning the literal to the seed script's copy so the two cannot drift apart again.
scripts/
One-shot operator and build scripts. These are not part of the running application — they are run by hand during a deploy, a backfill, or a release, or wired into CI. Recurring work belongs on pg-boss (src/lib/jobs/), not here.
How to run them
From a source checkout:
pnpm dlx tsx scripts/<file>.ts
The production image intentionally removes npm, pnpm, and Corepack. Only
container-safe scripts named by an operator runbook use its pinned
healthlog-tsx launcher; scripts that import the full application dependency
graph must run from a source checkout. scripts/ is excluded from the project
typecheck.
What lives here
generate-openapi.ts— emitsdocs/api/openapi.yamlfrom the registered Zod schemas (pnpm openapi:generate).check-openapi.ts— compares a freshly generated spec against the committed YAML; CI fails on drift (pnpm openapi:check).check-env.ts— pre-deploy env-var sanity check againstenv-manifest.json(pnpm check-env); wired into CI.assert-deploy.ts— post-deploy/api/versionassertion.rotate-encryption-key.ts— AES-256-GCM key rotation; seedocs/ops/encryption-key-rotation.md.restore-backup.ts— restore an off-host AES-GCM backup from an S3-compatible bucket.repair-intake-anomalies.ts— repair historic medication-ledger defects (duplicate dose-slot rows, implausibletaken_at); dry-run by default, seedocs/ops/intake-repair.md.backfill-rollups.ts,drain-per-sample-cumulative.ts,backfill-mood-note-column.ts— historical data backfills (note: the boot-timerollup-full-backfillqueue handles new accounts automatically; the CLI is the manual fallback).seed-demo.ts+seed-demo-v15.sql— populate a demo tenant.test-notifications.ts— exercise the notification dispatcher + reminder check.fetch-geolite2.sh— download the MaxMind GeoLite2 MMDBs (needs a licence key) beforedocker build.install-hooks.sh— install the local git hooks.generate-sw-version.mjs,print-bundle-report.mjs— service-worker version stamp and bundle-size report.i18n/— locale tooling;__tests__/— tests for the scripts above.
Conventions
See ../CLAUDE.md "Tests and commands" + "Self-hosting gotchas". Operator runbooks that drive these scripts live in ../docs/ops/.