mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 21:32:18 +00:00
The doctorReport module toggle was inert: turning it off hid nothing and the server-side export route accepted requests regardless. Gate the live surface on the module — the Health-record settings entry now hides client-side when the module is off, and POST /api/export/health-record refuses with a 403 module.disabled envelope, so the doctor-report surface cannot be reached over a Bearer token either.