Marc-André Bombeck 995bd2385a fix(auth): wrong passwords from elsewhere can no longer lock the owner out ...

The per-account password limit refused every attempt once ten failures
had landed in fifteen minutes, counted before the password was checked.
Ten guesses from two addresses therefore locked a password-only account,
the app's password sign-in included, and repeating them kept it locked
for as long as anyone cared to.

A place the account has signed in from before is now neither counted nor
held back: a remembered browser, a phone presenting the device id a login
of this account was issued to, or an address a session or device login of
this account came from in the last thirty days. Anywhere else gets five
free failures a day and then a wait that doubles with each failure, from
thirty seconds to at most fifteen minutes, instead of a wall. The per-IP
limit is unchanged, and an unknown identifier is limited the same way on
its hash.

Under an SSO-only policy, a password sign-in to an account other than the
one a pending link names is now refused before the password is checked,
so that exception no longer tells right passwords from wrong ones.

2026-09-26 22:42:40 +02:00

..

account-grant-lifecycle.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

achievements-expansion.test.ts

feat(achievements): worker re-evaluates new + hidden achievements on data change

2026-05-10 10:34:32 +02:00

acting-account-resolver.test.ts

feat(02-12.1): refuse a record request whose context has moved

2026-08-06 18:21:40 +02:00

admin-backups-audit.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

admin-backups-canonical-roundtrip.test.ts

fix(backup): bind new off-host objects to their key and account, and cap what an uploaded backup may inflate to

2026-09-26 20:18:55 +02:00

admin-backups-download.test.ts

fix(admin): /admin/users mobile layout — card-list at < md, no truncation

2026-05-09 20:46:20 +02:00

admin-backups-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

admin-backups-upload-too-large.test.ts

fix(backup): answer an upload too large to store with 413

2026-09-25 08:51:00 +02:00

admin-backups-upload.test.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

admin-data-wipe.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

admin-drain-cumulative-endpoint.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

admin-host-metrics.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

admin-reset-password.test.ts

test(01-03): add atomic reset revocation contracts

2026-07-29 13:42:04 +02:00

ai-capability-switches-migration.test.ts

test(ai): run the 0343 data steps against seeded rows

2026-09-24 07:54:59 +02:00

ai-extraction-capability.test.ts

style: format the extraction capability suite

2026-09-24 08:51:52 +02:00

ai-optional-actions.test.ts

test(ai): state the mutation checks the AI route tests were run against

2026-09-24 09:22:50 +02:00

ai-optional-data-routes.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

ai-optional-fixtures.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

ai-optional-jobs.test.ts

feat(ai): resolve the AI capability before any background model work

2026-09-24 09:07:16 +02:00

ai-optional-mixed-routes.test.ts

feat(ai): show stored model text inside a shared record as the owner would

2026-09-24 10:17:00 +02:00

analytics-bp-aggregate-paged.test.ts

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

analytics-health-score.test.ts

test: the two-domain case grades instead of going dark

2026-08-30 14:40:43 +02:00

analytics-sleep-stages.test.ts

test(integration): anchor the reconciled sleep night inside the 30-day window

2026-07-04 14:46:19 +02:00

analytics-summaries-slice.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

analytics-weekday-tz.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

apns-dispatch.test.ts

fix(02-11): bound APNs provider delivery

2026-08-06 14:10:28 +02:00

apple-health-distance-repair.test.ts

fix(ops): stop the distance repair losing its rollup tail in silence

2026-09-10 00:37:15 +02:00

apple-health-import-ecg.test.ts

test(01-12): add failing Apple ECG import contracts

2026-07-29 14:20:56 +02:00

apple-health-import-natural-key.test.ts

chore(release): v1.28.49 — Apple Health re-import survives a natural-key collision

2026-07-16 08:48:41 +02:00

apple-health-import-reconcile.test.ts

fix: harden imports and daily medication state (#577)

2026-07-21 13:08:28 +02:00

apple-health-import-rollup-window.test.ts

fix(import): fold rollups over the span the import wrote

2026-09-25 02:05:19 +02:00

apple-health-import-worker-failures.test.ts

fix(import): bound what an export may inflate to, allow one import per account, and never leave the upload behind

2026-09-26 20:11:45 +02:00

arrival-reaction-claim.test.ts

docs(ai): drop planning vocabulary from the ledger comments

2026-09-11 12:37:54 +02:00

auth-flow.test.ts

chore(db): renumber the session-token migration to 0255

2026-07-19 11:41:12 +02:00

auth-me-ai-capabilities.test.ts

test(ai): pin the account payload's capability block against Postgres

2026-09-24 07:53:28 +02:00

auth-password-change.test.ts

fix(auth): require a fresh proof before a second factor is added

2026-09-26 15:55:57 +02:00

backfill-workout-sport.test.ts

test(migrations): seed→apply→assert harness for the workout-sport backfills

2026-07-18 02:09:33 +02:00

background-switch-freshness.test.ts

fix(ai): read AI switches, modules and consent afresh inside background jobs

2026-09-24 12:08:39 +02:00

backup-chunked-storage.test.ts

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

backup-custom-cycle-symptom-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-cycle-symptom-severity-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-key-needs.test.ts

fix(backup): take off-host copies out with the account, and say which keys backups still need

2026-09-26 19:54:40 +02:00

backup-missing-section-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-portable-file-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-restore-boundaries.test.ts

fix(backup): refuse a restore that needs a dropped key or reaches into another account

2026-09-26 19:22:03 +02:00

backup-restore-job.test.ts

fix(backup): date a restored medication by its earliest record when the file has no date

2026-09-25 08:53:38 +02:00

backup-round-trip.test.ts

fix(privacy): encrypt Coach conversation titles and custom-metric notes at rest

2026-09-26 19:46:01 +02:00

backup-streaming-memory.test.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

backup-unknown-catalogue-key-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

bearer-scope-enforcement.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

biomarker-detail.test.ts

test(labs): integration coverage for biomarker target-range and delete

2026-06-28 14:00:55 +02:00

body-sites.test.ts

feat(body-sites): record a body site on conditions and add a body-site view

2026-09-25 21:55:14 +02:00

boot-discovery-scans.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

bp-in-target.test.ts

test(blood-pressure): pin the in-target headline and BP pillar to the 90-day window

2026-06-14 14:26:58 +02:00

briefing-cache-locale.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

bulk-delete-source-filter.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

cache-invalidation-coverage.test.ts

style: format the cache-invalidation coverage test

2026-06-27 22:40:01 +02:00

cascade-delete.test.ts

chore: remove the bug-report integration

2026-06-27 20:37:35 +02:00

chart-overlay-prefs.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

chart-range-dense.test.ts

fix(charts): read the 7-day range as daily rows

2026-09-24 08:03:04 +02:00

checkup-stays-due.test.ts

fix(migrations): tighten and widen the 0355 repair where the evidence allows

2026-09-26 10:41:02 +02:00

ci-environment.test.ts

chore(release): prepare v1.31.4

2026-07-21 01:34:29 +02:00

coach-availability-probe.test.ts

test(coach): prove the availability probe's SQL against Postgres

2026-07-26 18:34:42 +02:00

coach-budget-owner.test.ts

fix(ai): hold a reserve so the chat is never locked out by jobs

2026-09-11 12:55:52 +02:00

coach-budget-reservation.test.ts

docs(ai): drop planning vocabulary from the ledger comments

2026-09-11 12:37:54 +02:00

coach-chat.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

coach-conversation-documents.test.ts

feat(coach): attach multiple documents to a conversation

2026-07-16 23:32:28 +02:00

coach-conversations.test.ts

feat(coach): GET list, GET single, DELETE conversation endpoints

2026-05-10 16:11:12 +02:00

coach-feedback.test.ts

fix(coach): feedback references coach_messages, drops plaintext column

2026-05-11 02:38:17 +02:00

coach-prefs.test.ts

fix(coach-prefs): return the pure default with no token for a never-saved user

2026-07-24 18:28:41 +02:00

coach-reminder-surfacing.test.ts

fix(coach): hold reminders while the Coach is unavailable

2026-09-24 12:11:21 +02:00

coach-stale-rollup-tail.test.ts

Stop narrating rollup buckets the record cannot account for

2026-08-22 16:14:54 +02:00

consent-withdrawal-purge.test.ts

refactor(ai): re-check every chokepoint through the one egress helper

2026-09-24 09:29:00 +02:00

consolidate-daily-mean.test.ts

feat(measurements): consolidate gait/mobility HealthKit metrics nightly

2026-06-01 19:54:26 +02:00

consolidate-legacy-steps.test.ts

fix(measurements): legacy step consolidation no longer sweeps provider daily totals

2026-07-15 22:49:07 +02:00

correlations-rollup-swap.test.ts

Round-trip the rollup swap through the real writer

2026-08-13 22:07:57 +02:00

credential-enrollment-proof.test.ts

fix(auth): require a fresh proof before a second factor is added

2026-09-26 15:55:57 +02:00

csv-import-contextless-glucose.test.ts

test: derive the glucose import assertions from the shared factor

2026-09-03 07:42:59 +02:00

csv-reimport-idempotent.test.ts

fix(import): make re-importing the same CSV idempotent and fast

2026-09-26 19:58:50 +02:00

cumulative-pr-rederive-atomic.test.ts

fix(records): repair cumulative records in one transaction

2026-09-25 02:05:19 +02:00

cycle-crosstab-day-aggregates.test.ts

fix(tz): one default zone, and the user's own calendar where Berlin was hard-coded

2026-09-26 16:23:14 +02:00

cycle-flow-opens-cycle.test.ts

fix(cycle): reopen a re-tapped start that has nothing after it

2026-09-24 08:11:14 +02:00

cycle-import-export.test.ts

fix(backup): a retired catalogue key must not cost the whole file

2026-08-02 09:04:36 +02:00

cycle-insights-scoped-delegate.test.ts

docs(sharing): the booster needs two sections, and the guide promised it at one level

2026-09-10 12:23:59 +02:00

cycle-routes.test.ts

test(cycle): pin the fixture clock to the suite's clock

2026-08-08 01:02:08 +02:00

cycle-start-round-trip.test.ts

fix(cycle): give back a start that a mis-tapped earlier start folded in

2026-09-24 12:30:39 +02:00

daily-series-user-tz.test.ts

perf(measurements): fold each source before picking the canonical one

2026-09-24 12:37:51 +02:00

dashboard-glucose-untagged.test.ts

test: guard tile eligibility against a missing null arm

2026-09-09 23:03:38 +02:00

dashboard-snapshot-pre-window-types.test.ts

fix(dashboard): stop pre-window readings holding the second phase back

2026-09-25 13:48:31 +02:00

dashboard-summary-reads.test.ts

test: pin the dashboard summary read shapes against a plan regression

2026-09-03 01:47:52 +02:00

dashboard-widgets-save.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

delegated-intake-notification.test.ts

Route the delegated-dose alert through one helper that refuses on self

2026-08-03 09:52:02 +02:00

demo-mode-profile-write.test.ts

fix(demo): the profile route writes only the baseline fields in the demo

2026-09-11 12:22:47 +02:00

dense-intraday-hourly-rebuild.test.ts

feat(insights): day navigator on the intraday pulse chart; 90-day dense retention with hourly fallback

2026-07-17 14:29:07 +02:00

dense-intraday-retention.test.ts

feat(insights): day navigator on the intraday pulse chart; 90-day dense retention with hourly fallback

2026-07-17 14:29:07 +02:00

dense-read-bounded.test.ts

fix(tz): one default zone, and the user's own calendar where Berlin was hard-coded

2026-09-26 16:23:14 +02:00

device-register.test.ts

chore: align hardening tests and formatting

2026-07-20 12:24:15 +02:00

doctor-report-dense-data.test.ts

feat(vaccinations): publish the routes, classify them, gate the module

2026-08-08 14:27:36 +02:00

doctor-report-fixed-window.test.ts

fix(doctor-report): keep a report with a past end date inside its dates

2026-09-26 16:25:45 +02:00

doctor-report-sections.test.ts

fix(format): carry the date-order preference to every numeric date

2026-09-05 17:06:34 +02:00

document-sources.test.ts

fix(documents): an import of bytes deleted in HealthLog stays deleted under any source key

2026-09-26 14:42:13 +02:00

documents-content-index.test.ts

test(documents): pin contentIndexSource provenance through list/detail/PATCH

2026-07-08 22:05:05 +02:00

documents-import.test.ts

fix(documents): keep deferred imports local and meter every re-send

2026-09-26 00:38:26 +02:00

documents-vault.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

dose-history-pre-creation-slots.test.ts

chore(db): renumber the placeholder repair migration to 0350

2026-09-25 07:25:29 +02:00

drain-per-sample-cumulative.test.ts

fix: harden imports and daily medication state (#577)

2026-07-21 13:08:28 +02:00

ecg-ingest-roundtrip.test.ts

Stop the plaintext-waveform check passing on a coincidence

2026-08-01 19:35:16 +02:00

ecg-recording-identity-migration.test.ts

Prove the ECG ingest, the dedupe and the migration on dirty data

2026-08-01 19:26:47 +02:00

emergency-profile-migration.test.ts

feat(profile): add emergency profile storage

2026-08-10 05:32:58 +02:00

emergency-profile-route.test.ts

feat(api): add emergency profile read and write route

2026-08-10 05:32:59 +02:00

encounter-appointment-reminder.test.ts

Pin the orphan sweep in both directions

2026-08-08 12:20:19 +02:00

encounter-phase2-surfaces.test.ts

fix(encounters): the visit list carries its links

2026-08-08 15:06:10 +02:00

encounter-procedures.test.ts

feat(visits): record procedures and surgeries with a body site

2026-09-25 08:11:37 +02:00

encounter-scoped-delegate.test.ts

test(encounters): guard the batched link redaction on the visit list

2026-08-08 15:54:19 +02:00

encryption-corpus-cursor-row-deleted.test.ts

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

encryption-key-rotation-blobs.test.ts

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

environment-setup.ts

test: settle detached background work before a test file tears down

2026-09-03 05:30:08 +02:00

export-per-type.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

fitbit-activity-sleep-workout-sync.test.ts

test(fitbit): remap integration fixtures onto the classic Web API

2026-06-22 09:00:39 +02:00

fitbit-metrics-sync.test.ts

test(fitbit): remap integration fixtures onto the classic Web API

2026-06-22 09:00:39 +02:00

free-text-encryption-backfill.test.ts

fix(privacy): encrypt Coach conversation titles and custom-metric notes at rest

2026-09-26 19:46:01 +02:00

full-backup-nutrients.test.ts

fix(nutrients): bound the manual water writes and put nutrient totals in the backup

2026-07-19 13:40:03 +02:00

global-setup.ts

fix(ci): harden test determinism and dependencies

2026-07-21 00:36:40 +02:00

google-health-sync-progress.test.ts

test(01-13): add red Google sync progress contracts

2026-07-29 14:18:20 +02:00

google-health-workout-terminal.test.ts

test(01-13): add red Google sync terminal contracts

2026-07-29 14:22:49 +02:00

guardian-notification-fanout.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

health-profile-backup-roundtrip.test.ts

feat(backup): carry emergency profile through rotation and backup

2026-08-10 05:32:59 +02:00

health-score-configured-flag.test.ts

test(health-score): answer the provider probe in the configured-flag checks

2026-09-24 10:52:04 +02:00

health-score-labs-pillars.test.ts

fix(score): read biomarker bounds by their real column names

2026-08-12 22:52:03 +02:00

health-score-record.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

health-status-implausible-values.test.ts

fix(insights): keep impossible readings out of the personal band

2026-08-07 14:16:17 +02:00

idempotency-record-scoped-cell.test.ts

fix: reauthorize delegated replay

2026-08-06 01:29:07 +02:00

idempotency-replay.test.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

insight-status-cache-migration.test.ts

feat(insights): add an encrypted table for status notes

2026-09-24 09:03:58 +02:00

insights-comprehensive-cache.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

insights-feedback.test.ts

feat(api): /api/insights/feedback persists thumbs with provider attribution

2026-05-10 01:30:06 +02:00

insights-provider-chain-put.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

insights-provider-chain.test.ts

fix(ci): clear the v1.25 release-branch gate failures

2026-06-28 19:23:57 +02:00

insights-status-real-text.test.ts

feat(insights): serve status notes from the new table, only while available

2026-09-24 09:06:22 +02:00

intake-backfill-missed-slot.test.ts

fix(medications): attribute doses to slots from before the medication existed

2026-09-24 19:40:27 +02:00

intake-late-take-future-slot.test.ts

fix(medications): keep a late take off a future slot the card supplied

2026-07-07 15:55:50 +02:00

intake-scheduled-for-targeting.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

intake-slot-dedup.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

integration-failing-legs-backfill.test.ts

test(integrations): prove the leg backfill against rows that carry the old value

2026-07-27 14:35:34 +02:00

integration-status.test.ts

fix(status): expose background failures

2026-07-28 14:00:44 +02:00

integration-sync-escalation.test.ts

feat(integrations): tell the Apple Health card how the last sync arrived

2026-07-27 14:35:33 +02:00

inventory-expiry-container-type-repair.test.ts

test(db): follow the inventory repair to its new number

2026-07-26 18:02:35 +02:00

job-failures.test.ts

feat(jobs): log long-running, expired and cut-off jobs by queue

2026-09-25 00:31:30 +02:00

job-success-outcome.test.ts

fix(jobs): reconcile durable fact inventory

2026-07-29 15:59:27 +02:00

lab-source-reference-range.test.ts

Drop a reference window whose floor sits above its ceiling

2026-08-31 19:38:08 +02:00

large-account-jobs.test.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

large-backup-round-trip.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

link-service.test.ts

feat(documents): link a document to visits and vaccinations from its own sheet

2026-09-24 09:39:27 +02:00

list-pagination-tiebreaker.test.ts

fix(api): give every offset-paged list a unique tiebreaker

2026-09-10 04:01:14 +02:00

managed-profile-edit.test.ts

fix(test): read the audit details as the string the writer stores

2026-09-10 01:09:50 +02:00

managed-profile-guardian-concurrency.test.ts

test: cover managed profile Guardian races

2026-08-06 02:36:08 +02:00

managed-profile-lifecycle.test.ts

test: read the Guardian grant id under its published name

2026-08-07 05:24:11 +02:00

managed-profile-surface.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

managed-record-capabilities.test.ts

test(sharing): carry the two domain lists through the account-access contract

2026-09-09 20:06:48 +02:00

managed-record-modules.test.ts

feat(api): say why a module's surfaces are not there, not only that they are not

2026-09-10 04:41:38 +02:00

mcp-oauth-refresh-race.test.ts

style: satisfy v1.34.1 format gate

2026-07-29 15:59:12 +02:00

mcp-write-and-range-read.test.ts

test(mcp): notes and held-back document text stay off the wire against real Postgres

2026-09-26 13:29:36 +02:00

measurement-bulk-insert.test.ts

fix(import): write Apple Health spot rows without Prisma's per-call heap

2026-09-25 07:39:07 +02:00

measurement-identity-reconcile.test.ts

refactor(measurements): drop the write-only aggregation columns (migration 0272)

2026-07-25 15:03:44 +02:00

measurement-rollups.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurement-soft-delete.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurement-source-write-smoke.test.ts

test(measurements): cover EXTERNAL provenance on both write paths

2026-09-25 06:55:17 +02:00

measurements-aggregate-daily.test.ts

fix(measurements): cut chart day buckets at the user's midnight

2026-09-24 07:56:33 +02:00

measurements-batch-delete.test.ts

chore(release): v1.7.0

2026-05-31 14:36:17 +02:00

measurements-batch.test.ts

refactor(measurements): drop the write-only aggregation columns (migration 0272)

2026-07-25 15:03:44 +02:00

measurements-duplicate-conflict.test.ts

fix: answer a duplicate measurement with 409 on both write paths

2026-08-06 20:56:16 +02:00

measurements-named-sleep-stage.test.ts

Merge branch 'fix/v1391-contract-and-ingest' into release/v1.39.1

2026-09-25 08:04:30 +02:00

measurements-sleep-list.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-administrations.test.ts

test(export): prove the scope holds at the artefact, not just at the switch

2026-07-26 00:45:08 +02:00

medication-cadence-worker.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-compliance-rollup-slot.test.ts

fix(medications): converge intake writes onto existing slot rows across sources

2026-06-10 11:18:00 +02:00

medication-dose-history-import.test.ts

fix: retain import actor attribution

2026-08-06 02:00:35 +02:00

medication-intake-import-job.test.ts

fix: retain import actor attribution

2026-08-06 02:00:35 +02:00

medication-intake-import-reported-export.test.ts

fix: retain import actor attribution

2026-08-06 02:00:35 +02:00

medication-intake-tracking.test.ts

test(medications): pin the live-era floor, the nudge and the same-day edit cases

2026-09-25 10:31:22 +02:00

medication-per-slot-consumption.test.ts

test(medications): type the consumption stamp reduce accumulator

2026-08-10 07:58:48 +02:00

medication-reminder-cross-midnight.test.ts

test: observe the reminder dedup anchor where it is written

2026-08-07 06:02:31 +02:00

medication-rolling-overdue-consumers.test.ts

style: satisfy v1.34.1 format gate

2026-07-29 15:59:12 +02:00

medication-weekly-compliance.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-write-idempotency.test.ts

fix(api): accept an Idempotency-Key on the titration step and the custom symptom

2026-09-10 07:40:05 +02:00

medications-intake-bulk.test.ts

fix(medications): scope the intake idempotency key to its owner

2026-07-25 18:41:40 +02:00

mfa-login-flow.test.ts

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00

mock-next-headers.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

mood-a1-backfill.test.ts

feat(mood): map existing entries onto the pleasantness scale

2026-08-08 01:03:05 +02:00

mood-backup-round-trip.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

mood-context-linkage.test.ts

fix(mood): the linked day read crosses sections, so it declares record

2026-08-08 09:58:22 +02:00

mood-context.test.ts

fix(api): a bad dimension skips its own bulk entry, as the contract said

2026-08-08 09:58:50 +02:00

mood-dimension-features.test.ts

docs(mood): state the validation's real leak boundary, drop the unused weekday floor, correct two comments

2026-08-08 15:30:38 +02:00

mood-entries-bulk.test.ts

test(mood): align integration fixtures with the curated default catalog

2026-06-14 11:31:52 +02:00

mood-entries-external-id.test.ts

fix(mood): honour externalId for idempotent re-import on the native entry routes

2026-06-05 03:45:04 +02:00

mood-entries-note-column.test.ts

feat(security): add second-factor schema and encrypt free-text health notes at rest

2026-06-27 19:33:10 +02:00

mood-insights-crosstab.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

mood-prognosis-ladder.test.ts

fix(mood): refuse a forecast below the data floor on the read path, not only in the job

2026-08-08 15:30:00 +02:00

mood-tag-groups.test.ts

feat(insights): persist correlation patterns

2026-07-28 14:01:11 +02:00

mood-writers-agree.test.ts

fix(mood): one spelling on the wire, one day-key helper, one written decision

2026-08-08 03:03:38 +02:00

note-encryption-backfill.test.ts

feat(security): add second-factor schema and encrypt free-text health notes at rest

2026-06-27 19:33:10 +02:00

notification-attribution.test.ts

test(02-11): verify final claim uses database time

2026-08-06 13:47:42 +02:00

notification-global-channel-switch.test.ts

test(integration): wait for the ledger row, not for fifty milliseconds

2026-09-11 13:43:19 +02:00

nutrients-batch.test.ts

feat(nutrients): tell the account holder when a sync arrived but nothing landed

2026-07-30 23:30:28 +02:00

offhost-backup-ledger.test.ts

fix(backup): resume an off-host run where its last attempt stopped

2026-09-25 02:05:19 +02:00

offhost-backup-streaming-memory.test.ts

fix(backup): bind new off-host objects to their key and account, and cap what an uploaded backup may inflate to

2026-09-26 20:18:55 +02:00

offhost-purge-on-deletion.test.ts

fix(backup): take off-host copies out with the account, and say which keys backups still need

2026-09-26 19:54:40 +02:00

oidc-pending-link.test.ts

fix(auth): wrong passwords from elsewhere can no longer lock the owner out

2026-09-26 22:42:40 +02:00

onboarding-needs.test.ts

Never derive answers given for somebody else onto the guardian

2026-09-10 18:58:21 +02:00

openapi-response-shape.test.ts

test(api): use the real caps in the limiter mocks, and drop a stale pointer

2026-09-10 05:07:15 +02:00

partial-unique-live-rows.test.ts

feat(integrations): remove the moodLog integration

2026-07-25 11:36:18 +02:00

passkey-register.test.ts

fix(auth): require a fresh proof before a second factor is added

2026-09-26 15:55:57 +02:00

pr-detection-cumulative-paged.test.ts

perf(records): find the best cumulative day a day at a time

2026-09-25 02:05:19 +02:00

pr-detection-end-to-end.test.ts

test(score): pin the weight yardstick, the mood gate and rollup/live parity

2026-07-27 23:15:38 +02:00

practitioner-specialty-search.test.ts

feat(practitioners): search and group the address book by specialty

2026-08-09 06:53:57 +02:00

prisma-schema-name-drift.test.ts

fix(environment): name the enum type the database actually has

2026-07-26 14:37:57 +02:00

provider-token-refresh-serialization.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

queue-singleton-policy.integration.test.ts

Pin the queue policy decisions with tests

2026-07-19 02:31:45 +02:00

rate-limit-429-headers.test.ts

fix(api): dress only the 429s a limiter actually refused

2026-09-10 04:55:19 +02:00

rate-limit.test.ts

test(integration): stop the rate-limit reset test racing its own window

2026-09-09 22:55:53 +02:00

recent-proof.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

record-session-epoch-trigger.test.ts

feat(02-12.1): stamp a record-context epoch on every session

2026-08-06 17:52:10 +02:00

record-session-fence-idempotency.test.ts

test(02-12.1): prove the record-session fence end to end

2026-08-06 19:33:15 +02:00

record-session-fence.test.ts

feat(02-12.1): refuse a record request whose context has moved

2026-08-06 18:21:40 +02:00

record-settings-authorization.test.ts

test(record-settings): hold the module write to the shared helper

2026-09-10 15:35:52 +02:00

refresh-rotation-access-sunset.test.ts

fix(auth): sunset the rotated-away access token instead of revoking it

2026-09-06 15:36:35 +02:00

refresh-rotation-revoke-race.test.ts

fix(auth): end connected assistants, tokens and share links on sign-out everywhere

2026-09-26 20:06:36 +02:00

reset-password-revocation.test.ts

test(01-03): add atomic reset revocation contracts

2026-07-29 13:42:04 +02:00

restore-job-driver.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

rollup-concurrent-recompute.test.ts

chore(release): v1.28.33 — re-importing a cumulative Apple Health export works again

2026-07-14 11:56:29 +02:00

rollup-per-day-canonical.test.ts

perf(rollups): fold weekly, monthly and yearly buckets from canonical days in SQL

2026-09-26 16:56:02 +02:00

rollup-regression-parity.integration.test.ts

fix(rollups): rebase regression x-axis to a fixed origin for exact accumulators

2026-06-26 13:24:30 +02:00

second-factor-ends-other-sessions.test.ts

fix(auth): end connected assistants, tokens and share links on sign-out everywhere

2026-09-26 20:06:36 +02:00

server-cache-routes.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

session-cookie-validation.test.ts

test(oidc): cover the session resolver behind the duplicate-callback path

2026-07-23 15:16:48 +02:00

sessions-and-known-devices.test.ts

fix(sharing): invitations need a fresh proof and end with sign out everywhere

2026-09-26 22:34:21 +02:00

settings-account-delete.test.ts

chore(release): v1.4.45 — analytics 9 s perf fix + audit-marathon closure + v1.4.44 hotfix merged

2026-05-21 23:13:21 +02:00

settings-data-wipe.test.ts

Retire the five-step wizard's route, goals and columns

2026-09-10 15:32:35 +02:00

settings-erasure-bearer-step-up.test.ts

auth: let a token prove a second factor for erasure

2026-09-02 11:51:09 +02:00

setup.ts

test(integration): retry a truncate that lost a deadlock

2026-09-11 12:38:31 +02:00

share-link-documents.test.ts

test(share-links): drop the unused owner binding in the ownership guard

2026-07-07 22:00:14 +02:00

sharing-account-access.test.ts

test(sharing): carry the two domain lists through the account-access contract

2026-09-09 20:06:48 +02:00

sharing-audit-actor.test.ts

Harden the guards that could go green for the wrong reason

2026-08-14 02:33:07 +02:00

sharing-delegable-routes.test.ts

Let the GLP-1 read reach the record its own write already reaches

2026-08-22 13:04:33 +02:00

sharing-delegable-writes.test.ts

feat: open the anamnesis record surface to managers

2026-08-07 00:01:27 +02:00

sharing-front-door.test.ts

feat(ai): show stored model text inside a shared record as the owner would

2026-09-24 10:17:00 +02:00

sharing-idempotency-revocation.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-import-attribution.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-lifecycle.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-manage-handler-matrix.test.ts

Register the skip and snooze admissions in the MANAGE handler matrix

2026-08-14 14:27:58 +02:00

sharing-provider-origin.test.ts

test(sharing): read the real assistant switches in the provider-origin checks

2026-09-24 10:32:41 +02:00

sharing-scope-fence.test.ts

test(sharing): wait for the refusal audit row instead of guessing

2026-09-02 13:01:23 +02:00

sharing-scope-routes.test.ts

feat: add scoped record invitations

2026-08-05 23:58:30 +02:00

sleep-entry-hours-round-trip.test.ts

fix(measurements): store a hand-entered night in the unit the field asks for

2026-08-07 14:30:10 +02:00

soft-delete-copy-parity.test.ts

test(settings): prove the wipe against real Postgres, and state what deletion means

2026-07-26 14:04:44 +02:00

source-aware-rollups.integration.test.ts

feat(rollups): collapse overlapping sources across all read paths

2026-06-04 10:05:47 +02:00

source-priority-two-axis.test.ts

fix(analytics): restore device-priority sleep selection

2026-07-29 16:08:41 +02:00

step-consolidation-repair.test.ts

fix(measurements): legacy step consolidation no longer sweeps provider daily totals

2026-07-15 22:49:07 +02:00

step-up-elevation.test.ts

fix(auth): end connected assistants, tokens and share links on sign-out everywhere

2026-09-26 20:06:36 +02:00

stored-backup-read.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

summaries-pre-window-buckets.test.ts

fix(analytics): count each reading once in the all-time summaries

2026-09-25 14:10:56 +02:00

switched-session-destructive-refusal.test.ts

docs(api): publish the switch refusal on the wipe, the deletion and the encrypted export

2026-09-10 10:49:12 +02:00

sync-changes.test.ts

Anchor the sync fixtures on a relative clock

2026-08-03 10:34:48 +02:00

sync-state.test.ts

Move the contract tests to the end that now writes

2026-08-02 02:00:08 +02:00

timezone-per-user.test.ts

fix(charts): cut days in the account's zone when a mount passes none

2026-09-24 08:15:16 +02:00

user-avatar.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

vaccination-booster-mint.test.ts

feat(vaccinations): mint the booster reminder a logged dose suggests

2026-08-08 21:01:25 +02:00

vaccination-booster-satisfy.test.ts

feat(vaccinations): let a logged dose clear the boosters it answers

2026-08-08 14:36:08 +02:00

vaccination-booster-scoped-delegate.test.ts

fix(vaccinations): keep the booster mint inside the sections the grant opens

2026-09-10 11:11:38 +02:00

vaccination-managed-profile.test.ts

test(vaccinations): prove the managed-profile and scoped-grant record paths

2026-08-08 23:00:39 +02:00

vaccination-renewal.test.ts

feat(vaccinations): show the planned booster's renewal state on the log

2026-09-24 09:44:51 +02:00

webauthn-challenge-claim.test.ts

fix(auth): claim a WebAuthn challenge in the statement that checks it

2026-09-26 20:22:12 +02:00

whoop-connect-ticket.test.ts

feat(whoop): native-scheme connect redirect and Bearer connect ticket

2026-06-05 08:10:13 +02:00

whoop-owner-identity.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

wipe-seeder.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

withings-activity-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

withings-oauth-flow.test.ts

test(withings): expect the no-credentials connect to redirect, not 400

2026-07-18 02:30:33 +02:00

withings-oauth.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

withings-sleep-stage-composite.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

withings-sleep-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

workout-batch-create.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

workout-batch-enrich.test.ts

test(workouts): pin the losing side of a concurrent enrichment

2026-08-08 09:53:09 +02:00

workout-batch-race.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

workout-detail-hr-series.test.ts

test(integration): keep the HR-curve fixture inside the retention horizon

2026-08-13 10:25:39 +02:00

workout-insight-claim.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00