mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
1f4ba5939d
One-shot prettier pass so the new format:check gate starts from a clean baseline. Formatting only — no behaviour change. Generator-owned and vendored artifacts stay untouched via .prettierignore.
68 lines
2.5 KiB
TypeScript
68 lines
2.5 KiB
TypeScript
import { z } from "zod/v4";
|
|
|
|
/**
|
|
* v1.4.40 SB-10 — AI consent receipts (App-Store Guideline 5.1.2(i) +
|
|
* GDPR Art. 7 audit trail).
|
|
*
|
|
* The discriminator covers the three consent surfaces the iOS client
|
|
* collects independently:
|
|
* - `ai_full` full assistant + on-device personalisation
|
|
* - `ai_insights_only` read-only Insights generation (no Coach)
|
|
* - `ai_coach` chat-style Coach access
|
|
*
|
|
* Keeping each surface as its own row means the legal team can prove
|
|
* which exact scope the user agreed to without parsing the signed
|
|
* artefact server-side. The server stays opaque to the artefact's
|
|
* format — we accept either a base64-encoded PDF or a signed JWT, the
|
|
* audit trail *is* the storage plus the `signedAt` timestamp.
|
|
*/
|
|
export const consentKindEnum = z.enum([
|
|
"ai_full",
|
|
"ai_insights_only",
|
|
"ai_coach",
|
|
]);
|
|
|
|
export type ConsentKind = z.infer<typeof consentKindEnum>;
|
|
|
|
/**
|
|
* 64 KB upper bound on the artefact. A signed PDF receipt sits well
|
|
* under 32 KB; a signed JWT is a few hundred bytes. The cap exists so
|
|
* a misbehaving client (or a malicious one) can't fill the audit table
|
|
* with multi-megabyte rows.
|
|
*
|
|
* v1.4.40 security M1 — the cap is enforced via `Buffer.byteLength(...,
|
|
* "utf8")` because `z.string().max()` counts JavaScript string units
|
|
* (UTF-16 code units), not bytes. A UTF-8 artefact full of multi-byte
|
|
* code points (CJK, emoji) would otherwise be allowed past the 64 KB
|
|
* row budget — the database stores bytes, not code units, and the
|
|
* audit-table guarantee is byte-bounded.
|
|
*/
|
|
const ARTEFACT_MAX_BYTES = 64 * 1024;
|
|
|
|
export const consentPostBody = z.object({
|
|
kind: consentKindEnum,
|
|
artefact: z
|
|
.string()
|
|
.min(1, "artefact must not be empty")
|
|
.refine((value) => Buffer.byteLength(value, "utf8") <= ARTEFACT_MAX_BYTES, {
|
|
message: "artefact exceeds 64 KB cap (UTF-8 byte length)",
|
|
}),
|
|
signedAt: z.iso.datetime({ offset: true }).transform((s) => new Date(s)),
|
|
});
|
|
|
|
export type ConsentPostBody = z.infer<typeof consentPostBody>;
|
|
|
|
/**
|
|
* Query schema for both `/api/consent/ai/latest` GET and DELETE.
|
|
*
|
|
* Omitting `kind` on GET returns the latest active receipt per kind
|
|
* (a `Record<ConsentKind, …>` shape). Omitting it on DELETE revokes
|
|
* the latest receipt across all three kinds — handy for the iOS
|
|
* "deaktivieren alle KI-Funktionen" master toggle.
|
|
*/
|
|
export const consentLatestQuery = z.object({
|
|
kind: consentKindEnum.optional(),
|
|
});
|
|
|
|
export type ConsentLatestQuery = z.infer<typeof consentLatestQuery>;
|