mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André Bombeck
9269043e91
Add the user-facing account-security surface in Settings: - Active sessions (closes #64): GET /api/auth/me/sessions lists each browser login with a coarse device label, masked IP, resolved location, the sliding last-active stamp, and the current-session marker. DELETE the collection signs out everywhere else (keeps the current session, revokes other sessions and native refresh tokens, leaves API tokens alone); DELETE one revokes a single session, scoped to the owner so a foreign id 404s. - A sliding last-active stamp on the session, written throttled and fire-and-forget off the request-resolution path. - Security activity: GET /api/auth/me/security-activity, the shared read over the audit log filtered to sign-ins, second-factor changes, password changes, session revocations, exports, and deletions, with masked IPs. OpenAPI regenerated for the new endpoints.
71 lines
2.9 KiB
TypeScript
71 lines
2.9 KiB
TypeScript
/**
|
|
* Query keys — auth session, passkeys, and per-user account preferences.
|
|
* Part of the centralized factory; aggregated in `./index.ts`.
|
|
*/
|
|
export const authKeys = {
|
|
auth: () => ["auth"] as const,
|
|
/**
|
|
* v1.4.40 W-RSC — the `useAuth` hook's `["auth", "me"]` shape was a
|
|
* recurring source of factory drift (audit H1 — "`useAuth` uses
|
|
* `["auth", "me"]` but `queryKeys.auth()` returns `["auth"]`"). Both
|
|
* shapes share the `["auth"]` prefix so existing prefix-invalidations
|
|
* still match, but the centralised name makes the call site
|
|
* obviously factory-routed.
|
|
*/
|
|
authMe: () => ["auth", "me"] as const,
|
|
authRegistrationStatus: () => ["auth", "registration-status"] as const,
|
|
/**
|
|
* v1.4.40 W-RSC — Settings → AI surfaces and the targets editor
|
|
* subscribe to the user-thresholds API. Centralise the key so a
|
|
* future rename (e.g. `["user","limits"]`) doesn't drift across the
|
|
* three call sites (settings/thresholds-editor-section,
|
|
* settings/ai-section, targets/target-edit-sheet).
|
|
*/
|
|
userThresholds: () => ["user", "thresholds"] as const,
|
|
/**
|
|
* v1.7.0 — Settings → Display metric/imperial control reads its
|
|
* current value from `GET /api/auth/me/unit-preference`. The PATCH
|
|
* mutation also invalidates `authMe()` so `useAuth().unitPreference`
|
|
* (and every chart display transform that keys off it) re-renders
|
|
* without a manual reload.
|
|
*/
|
|
userUnitPreference: () => ["user", "unit-preference"] as const,
|
|
|
|
passkeys: () => ["passkeys"] as const,
|
|
|
|
/**
|
|
* v1.23 — the user-facing active-session list behind
|
|
* `GET /api/auth/me/sessions`. Revoking a single session or signing out
|
|
* everywhere invalidates this key so the surface re-reads the live set.
|
|
*/
|
|
sessions: () => ["auth", "sessions"] as const,
|
|
|
|
/**
|
|
* v1.23 — the shared security-activity feed behind
|
|
* `GET /api/auth/me/security-activity` (logins, MFA, password change,
|
|
* session revoke, exports, deletions). Consumed by the account-security
|
|
* surface and the privacy dashboard.
|
|
*/
|
|
securityActivity: () => ["auth", "security-activity"] as const,
|
|
|
|
userAiProvider: () => ["user", "ai-provider"] as const,
|
|
userProfile: () => ["user", "profile"] as const,
|
|
/**
|
|
* v1.7.0 — the roaming notification prefs blob behind
|
|
* `GET/PATCH /api/auth/me/notification-prefs` (medication delivery
|
|
* default + mood reminder hour). Distinct from
|
|
* `notificationsPreferences()` (the per-event push toggles on the
|
|
* `/notifications` page) so the two never collide in the cache.
|
|
*/
|
|
authNotificationPrefs: () => ["auth", "me", "notification-prefs"] as const,
|
|
|
|
/**
|
|
* v1.4.25 W5e — per-user, per-metric-class source priority. The
|
|
* Settings → Sources surface reads + writes this key; saving
|
|
* invalidates `analytics()` because the cumulative-metric aggregator
|
|
* folds the new priority into the SLEEP_DURATION daily total
|
|
* immediately.
|
|
*/
|
|
sourcePriority: () => ["auth", "source-priority"] as const,
|
|
};
|