Marc-André Bombeck 8da7583ec6 fix(auth): link single sign-on to an existing account only after its own sign-in ...

The SSO callback bound a verified provider email to the local account with
the same address on the spot. The local address is not verified: anyone
could register with it, or type it into their profile, and the SSO user
then landed in an account the other person still held the password to.

The callback now links nothing. It records the link it would make in a
sealed, ten-minute, HttpOnly cookie and sends the browser to the sign-in
page, and the link is made only when that browser then signs in to that
same account with its password (and second factor) or passkey. Under an
SSO-only policy the password form opens for exactly that account. The
native sign-in answers oidc_link_required; the link is confirmed once on
the web.

Moving an account to a new email address now also needs a fresh proof: a
sign-in or second factor in the last five minutes, or the current password
sent alongside the change. Without it the address is left as it was and
reported in rejectedFields; the rest of the save still lands.

2026-09-26 16:10:32 +02:00

..

account-grant-lifecycle.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

achievements-expansion.test.ts

feat(achievements): worker re-evaluates new + hidden achievements on data change

2026-05-10 10:34:32 +02:00

acting-account-resolver.test.ts

feat(02-12.1): refuse a record request whose context has moved

2026-08-06 18:21:40 +02:00

admin-backups-audit.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

admin-backups-canonical-roundtrip.test.ts

fix(backup): keep an empty provenance empty on restore

2026-09-25 22:40:08 +02:00

admin-backups-download.test.ts

fix(admin): /admin/users mobile layout — card-list at < md, no truncation

2026-05-09 20:46:20 +02:00

admin-backups-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

admin-backups-upload-too-large.test.ts

fix(backup): answer an upload too large to store with 413

2026-09-25 08:51:00 +02:00

admin-backups-upload.test.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

admin-data-wipe.test.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

admin-drain-cumulative-endpoint.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

admin-host-metrics.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

admin-reset-password.test.ts

test(01-03): add atomic reset revocation contracts

2026-07-29 13:42:04 +02:00

ai-capability-switches-migration.test.ts

test(ai): run the 0343 data steps against seeded rows

2026-09-24 07:54:59 +02:00

ai-extraction-capability.test.ts

style: format the extraction capability suite

2026-09-24 08:51:52 +02:00

ai-optional-actions.test.ts

test(ai): state the mutation checks the AI route tests were run against

2026-09-24 09:22:50 +02:00

ai-optional-data-routes.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

ai-optional-fixtures.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

ai-optional-jobs.test.ts

feat(ai): resolve the AI capability before any background model work

2026-09-24 09:07:16 +02:00

ai-optional-mixed-routes.test.ts

feat(ai): show stored model text inside a shared record as the owner would

2026-09-24 10:17:00 +02:00

analytics-bp-aggregate-paged.test.ts

style: apply prettier 3.9.1 formatting

2026-06-28 19:26:16 +02:00

analytics-health-score.test.ts

test: the two-domain case grades instead of going dark

2026-08-30 14:40:43 +02:00

analytics-sleep-stages.test.ts

test(integration): anchor the reconciled sleep night inside the 30-day window

2026-07-04 14:46:19 +02:00

analytics-summaries-slice.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

analytics-weekday-tz.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

apns-dispatch.test.ts

fix(02-11): bound APNs provider delivery

2026-08-06 14:10:28 +02:00

apple-health-distance-repair.test.ts

fix(ops): stop the distance repair losing its rollup tail in silence

2026-09-10 00:37:15 +02:00

apple-health-import-ecg.test.ts

test(01-12): add failing Apple ECG import contracts

2026-07-29 14:20:56 +02:00

apple-health-import-natural-key.test.ts

chore(release): v1.28.49 — Apple Health re-import survives a natural-key collision

2026-07-16 08:48:41 +02:00

apple-health-import-reconcile.test.ts

fix: harden imports and daily medication state (#577)

2026-07-21 13:08:28 +02:00

apple-health-import-rollup-window.test.ts

fix(import): fold rollups over the span the import wrote

2026-09-25 02:05:19 +02:00

apple-health-import-worker-failures.test.ts

fix(analytics,ci): merge health-score meta annotations, migrate integration tests, remove dead exports, raise bundle budget

2026-07-28 23:02:00 +02:00

arrival-reaction-claim.test.ts

docs(ai): drop planning vocabulary from the ledger comments

2026-09-11 12:37:54 +02:00

auth-flow.test.ts

chore(db): renumber the session-token migration to 0255

2026-07-19 11:41:12 +02:00

auth-me-ai-capabilities.test.ts

test(ai): pin the account payload's capability block against Postgres

2026-09-24 07:53:28 +02:00

auth-password-change.test.ts

fix(auth): require a fresh proof before a second factor is added

2026-09-26 15:55:57 +02:00

backfill-workout-sport.test.ts

test(migrations): seed→apply→assert harness for the workout-sport backfills

2026-07-18 02:09:33 +02:00

background-switch-freshness.test.ts

fix(ai): read AI switches, modules and consent afresh inside background jobs

2026-09-24 12:08:39 +02:00

backup-chunked-storage.test.ts

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

backup-custom-cycle-symptom-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-cycle-symptom-severity-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-missing-section-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-portable-file-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-restore-job.test.ts

fix(backup): date a restored medication by its earliest record when the file has no date

2026-09-25 08:53:38 +02:00

backup-round-trip.test.ts

Merge branch 'fix/backup-chunked-storage' into release/v1.39.2

2026-09-26 01:03:25 +02:00

backup-streaming-memory.test.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

backup-unknown-catalogue-key-restore.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

bearer-scope-enforcement.test.ts

test(measurements): cover EXTERNAL provenance on both write paths

2026-09-25 06:55:17 +02:00

biomarker-detail.test.ts

test(labs): integration coverage for biomarker target-range and delete

2026-06-28 14:00:55 +02:00

body-sites.test.ts

feat(body-sites): record a body site on conditions and add a body-site view

2026-09-25 21:55:14 +02:00

boot-discovery-scans.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

bp-in-target.test.ts

test(blood-pressure): pin the in-target headline and BP pillar to the 90-day window

2026-06-14 14:26:58 +02:00

briefing-cache-locale.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

bulk-delete-source-filter.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

cache-invalidation-coverage.test.ts

style: format the cache-invalidation coverage test

2026-06-27 22:40:01 +02:00

cascade-delete.test.ts

chore: remove the bug-report integration

2026-06-27 20:37:35 +02:00

chart-overlay-prefs.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

chart-range-dense.test.ts

fix(charts): read the 7-day range as daily rows

2026-09-24 08:03:04 +02:00

checkup-stays-due.test.ts

fix(migrations): tighten and widen the 0355 repair where the evidence allows

2026-09-26 10:41:02 +02:00

ci-environment.test.ts

chore(release): prepare v1.31.4

2026-07-21 01:34:29 +02:00

coach-availability-probe.test.ts

test(coach): prove the availability probe's SQL against Postgres

2026-07-26 18:34:42 +02:00

coach-budget-owner.test.ts

fix(ai): hold a reserve so the chat is never locked out by jobs

2026-09-11 12:55:52 +02:00

coach-budget-reservation.test.ts

docs(ai): drop planning vocabulary from the ledger comments

2026-09-11 12:37:54 +02:00

coach-chat.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

coach-conversation-documents.test.ts

feat(coach): attach multiple documents to a conversation

2026-07-16 23:32:28 +02:00

coach-conversations.test.ts

feat(coach): GET list, GET single, DELETE conversation endpoints

2026-05-10 16:11:12 +02:00

coach-feedback.test.ts

fix(coach): feedback references coach_messages, drops plaintext column

2026-05-11 02:38:17 +02:00

coach-prefs.test.ts

fix(coach-prefs): return the pure default with no token for a never-saved user

2026-07-24 18:28:41 +02:00

coach-reminder-surfacing.test.ts

fix(coach): hold reminders while the Coach is unavailable

2026-09-24 12:11:21 +02:00

coach-stale-rollup-tail.test.ts

Stop narrating rollup buckets the record cannot account for

2026-08-22 16:14:54 +02:00

consent-withdrawal-purge.test.ts

refactor(ai): re-check every chokepoint through the one egress helper

2026-09-24 09:29:00 +02:00

consolidate-daily-mean.test.ts

feat(measurements): consolidate gait/mobility HealthKit metrics nightly

2026-06-01 19:54:26 +02:00

consolidate-legacy-steps.test.ts

fix(measurements): legacy step consolidation no longer sweeps provider daily totals

2026-07-15 22:49:07 +02:00

correlations-rollup-swap.test.ts

Round-trip the rollup swap through the real writer

2026-08-13 22:07:57 +02:00

credential-enrollment-proof.test.ts

fix(auth): require a fresh proof before a second factor is added

2026-09-26 15:55:57 +02:00

csv-import-contextless-glucose.test.ts

test: derive the glucose import assertions from the shared factor

2026-09-03 07:42:59 +02:00

cumulative-pr-rederive-atomic.test.ts

fix(records): repair cumulative records in one transaction

2026-09-25 02:05:19 +02:00

cycle-crosstab-day-aggregates.test.ts

fix(cycle): read the phase crosstab as per-source day aggregates

2026-09-24 08:06:47 +02:00

cycle-flow-opens-cycle.test.ts

fix(cycle): reopen a re-tapped start that has nothing after it

2026-09-24 08:11:14 +02:00

cycle-import-export.test.ts

fix(backup): a retired catalogue key must not cost the whole file

2026-08-02 09:04:36 +02:00

cycle-insights-scoped-delegate.test.ts

docs(sharing): the booster needs two sections, and the guide promised it at one level

2026-09-10 12:23:59 +02:00

cycle-routes.test.ts

test(cycle): pin the fixture clock to the suite's clock

2026-08-08 01:02:08 +02:00

cycle-start-round-trip.test.ts

fix(cycle): give back a start that a mis-tapped earlier start folded in

2026-09-24 12:30:39 +02:00

daily-series-user-tz.test.ts

perf(measurements): fold each source before picking the canonical one

2026-09-24 12:37:51 +02:00

dashboard-glucose-untagged.test.ts

test: guard tile eligibility against a missing null arm

2026-09-09 23:03:38 +02:00

dashboard-snapshot-pre-window-types.test.ts

fix(dashboard): stop pre-window readings holding the second phase back

2026-09-25 13:48:31 +02:00

dashboard-summary-reads.test.ts

test: pin the dashboard summary read shapes against a plan regression

2026-09-03 01:47:52 +02:00

dashboard-widgets-save.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

delegated-intake-notification.test.ts

Route the delegated-dose alert through one helper that refuses on self

2026-08-03 09:52:02 +02:00

demo-mode-profile-write.test.ts

fix(demo): the profile route writes only the baseline fields in the demo

2026-09-11 12:22:47 +02:00

dense-intraday-hourly-rebuild.test.ts

feat(insights): day navigator on the intraday pulse chart; 90-day dense retention with hourly fallback

2026-07-17 14:29:07 +02:00

dense-intraday-retention.test.ts

feat(insights): day navigator on the intraday pulse chart; 90-day dense retention with hourly fallback

2026-07-17 14:29:07 +02:00

dense-read-bounded.test.ts

fix(insights): fold dense measurement reads per day in SQL

2026-09-24 07:56:39 +02:00

device-register.test.ts

chore: align hardening tests and formatting

2026-07-20 12:24:15 +02:00

doctor-report-dense-data.test.ts

feat(vaccinations): publish the routes, classify them, gate the module

2026-08-08 14:27:36 +02:00

doctor-report-sections.test.ts

fix(format): carry the date-order preference to every numeric date

2026-09-05 17:06:34 +02:00

documents-content-index.test.ts

test(documents): pin contentIndexSource provenance through list/detail/PATCH

2026-07-08 22:05:05 +02:00

documents-import.test.ts

fix(documents): keep deferred imports local and meter every re-send

2026-09-26 00:38:26 +02:00

documents-vault.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

dose-history-pre-creation-slots.test.ts

chore(db): renumber the placeholder repair migration to 0350

2026-09-25 07:25:29 +02:00

drain-per-sample-cumulative.test.ts

fix: harden imports and daily medication state (#577)

2026-07-21 13:08:28 +02:00

ecg-ingest-roundtrip.test.ts

Stop the plaintext-waveform check passing on a coincidence

2026-08-01 19:35:16 +02:00

ecg-recording-identity-migration.test.ts

Prove the ECG ingest, the dedupe and the migration on dirty data

2026-08-01 19:26:47 +02:00

emergency-profile-migration.test.ts

feat(profile): add emergency profile storage

2026-08-10 05:32:58 +02:00

emergency-profile-route.test.ts

feat(api): add emergency profile read and write route

2026-08-10 05:32:59 +02:00

encounter-appointment-reminder.test.ts

Pin the orphan sweep in both directions

2026-08-08 12:20:19 +02:00

encounter-phase2-surfaces.test.ts

fix(encounters): the visit list carries its links

2026-08-08 15:06:10 +02:00

encounter-procedures.test.ts

feat(visits): record procedures and surgeries with a body site

2026-09-25 08:11:37 +02:00

encounter-scoped-delegate.test.ts

test(encounters): guard the batched link redaction on the visit list

2026-08-08 15:54:19 +02:00

encryption-corpus-cursor-row-deleted.test.ts

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

encryption-key-rotation-blobs.test.ts

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

environment-setup.ts

test: settle detached background work before a test file tears down

2026-09-03 05:30:08 +02:00

export-per-type.test.ts

test(export): integration test points at the new plain-segment endpoints

2026-05-10 00:11:36 +02:00

fitbit-activity-sleep-workout-sync.test.ts

test(fitbit): remap integration fixtures onto the classic Web API

2026-06-22 09:00:39 +02:00

fitbit-metrics-sync.test.ts

test(fitbit): remap integration fixtures onto the classic Web API

2026-06-22 09:00:39 +02:00

full-backup-nutrients.test.ts

fix(nutrients): bound the manual water writes and put nutrient totals in the backup

2026-07-19 13:40:03 +02:00

global-setup.ts

fix(ci): harden test determinism and dependencies

2026-07-21 00:36:40 +02:00

google-health-sync-progress.test.ts

test(01-13): add red Google sync progress contracts

2026-07-29 14:18:20 +02:00

google-health-workout-terminal.test.ts

test(01-13): add red Google sync terminal contracts

2026-07-29 14:22:49 +02:00

guardian-notification-fanout.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

health-profile-backup-roundtrip.test.ts

feat(backup): carry emergency profile through rotation and backup

2026-08-10 05:32:59 +02:00

health-score-configured-flag.test.ts

test(health-score): answer the provider probe in the configured-flag checks

2026-09-24 10:52:04 +02:00

health-score-labs-pillars.test.ts

fix(score): read biomarker bounds by their real column names

2026-08-12 22:52:03 +02:00

health-score-record.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

health-status-implausible-values.test.ts

fix(insights): keep impossible readings out of the personal band

2026-08-07 14:16:17 +02:00

idempotency-record-scoped-cell.test.ts

fix: reauthorize delegated replay

2026-08-06 01:29:07 +02:00

idempotency-replay.test.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

insight-status-cache-migration.test.ts

feat(insights): add an encrypted table for status notes

2026-09-24 09:03:58 +02:00

insights-comprehensive-cache.test.ts

test(ai): prove Insights data, mixed reads and actions against Postgres

2026-09-24 09:19:43 +02:00

insights-feedback.test.ts

feat(api): /api/insights/feedback persists thumbs with provider attribution

2026-05-10 01:30:06 +02:00

insights-provider-chain-put.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

insights-provider-chain.test.ts

fix(ci): clear the v1.25 release-branch gate failures

2026-06-28 19:23:57 +02:00

insights-status-real-text.test.ts

feat(insights): serve status notes from the new table, only while available

2026-09-24 09:06:22 +02:00

intake-backfill-missed-slot.test.ts

fix(medications): attribute doses to slots from before the medication existed

2026-09-24 19:40:27 +02:00

intake-late-take-future-slot.test.ts

fix(medications): keep a late take off a future slot the card supplied

2026-07-07 15:55:50 +02:00

intake-scheduled-for-targeting.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

intake-slot-dedup.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

integration-failing-legs-backfill.test.ts

test(integrations): prove the leg backfill against rows that carry the old value

2026-07-27 14:35:34 +02:00

integration-status.test.ts

fix(status): expose background failures

2026-07-28 14:00:44 +02:00

integration-sync-escalation.test.ts

feat(integrations): tell the Apple Health card how the last sync arrived

2026-07-27 14:35:33 +02:00

inventory-expiry-container-type-repair.test.ts

test(db): follow the inventory repair to its new number

2026-07-26 18:02:35 +02:00

job-failures.test.ts

feat(jobs): log long-running, expired and cut-off jobs by queue

2026-09-25 00:31:30 +02:00

job-success-outcome.test.ts

fix(jobs): reconcile durable fact inventory

2026-07-29 15:59:27 +02:00

lab-source-reference-range.test.ts

Drop a reference window whose floor sits above its ceiling

2026-08-31 19:38:08 +02:00

large-account-jobs.test.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

large-backup-round-trip.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

link-service.test.ts

feat(documents): link a document to visits and vaccinations from its own sheet

2026-09-24 09:39:27 +02:00

list-pagination-tiebreaker.test.ts

fix(api): give every offset-paged list a unique tiebreaker

2026-09-10 04:01:14 +02:00

managed-profile-edit.test.ts

fix(test): read the audit details as the string the writer stores

2026-09-10 01:09:50 +02:00

managed-profile-guardian-concurrency.test.ts

test: cover managed profile Guardian races

2026-08-06 02:36:08 +02:00

managed-profile-lifecycle.test.ts

test: read the Guardian grant id under its published name

2026-08-07 05:24:11 +02:00

managed-profile-surface.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

managed-record-capabilities.test.ts

test(sharing): carry the two domain lists through the account-access contract

2026-09-09 20:06:48 +02:00

managed-record-modules.test.ts

feat(api): say why a module's surfaces are not there, not only that they are not

2026-09-10 04:41:38 +02:00

mcp-oauth-refresh-race.test.ts

style: satisfy v1.34.1 format gate

2026-07-29 15:59:12 +02:00

mcp-write-and-range-read.test.ts

Expect the fenced label on the real-DB preventive-care read

2026-08-14 03:56:38 +02:00

measurement-bulk-insert.test.ts

fix(import): write Apple Health spot rows without Prisma's per-call heap

2026-09-25 07:39:07 +02:00

measurement-identity-reconcile.test.ts

refactor(measurements): drop the write-only aggregation columns (migration 0272)

2026-07-25 15:03:44 +02:00

measurement-rollups.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurement-soft-delete.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

measurement-source-write-smoke.test.ts

test(measurements): cover EXTERNAL provenance on both write paths

2026-09-25 06:55:17 +02:00

measurements-aggregate-daily.test.ts

fix(measurements): cut chart day buckets at the user's midnight

2026-09-24 07:56:33 +02:00

measurements-batch-delete.test.ts

chore(release): v1.7.0

2026-05-31 14:36:17 +02:00

measurements-batch.test.ts

refactor(measurements): drop the write-only aggregation columns (migration 0272)

2026-07-25 15:03:44 +02:00

measurements-duplicate-conflict.test.ts

fix: answer a duplicate measurement with 409 on both write paths

2026-08-06 20:56:16 +02:00

measurements-named-sleep-stage.test.ts

Merge branch 'fix/v1391-contract-and-ingest' into release/v1.39.1

2026-09-25 08:04:30 +02:00

measurements-sleep-list.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-administrations.test.ts

test(export): prove the scope holds at the artefact, not just at the switch

2026-07-26 00:45:08 +02:00

medication-cadence-worker.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-compliance-rollup-slot.test.ts

fix(medications): converge intake writes onto existing slot rows across sources

2026-06-10 11:18:00 +02:00

medication-dose-history-import.test.ts

fix: retain import actor attribution

2026-08-06 02:00:35 +02:00

medication-intake-import-job.test.ts

fix: retain import actor attribution

2026-08-06 02:00:35 +02:00

medication-intake-import-reported-export.test.ts

fix: retain import actor attribution

2026-08-06 02:00:35 +02:00

medication-intake-tracking.test.ts

test(medications): pin the live-era floor, the nudge and the same-day edit cases

2026-09-25 10:31:22 +02:00

medication-per-slot-consumption.test.ts

test(medications): type the consumption stamp reduce accumulator

2026-08-10 07:58:48 +02:00

medication-reminder-cross-midnight.test.ts

test: observe the reminder dedup anchor where it is written

2026-08-07 06:02:31 +02:00

medication-rolling-overdue-consumers.test.ts

style: satisfy v1.34.1 format gate

2026-07-29 15:59:12 +02:00

medication-weekly-compliance.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

medication-write-idempotency.test.ts

fix(api): accept an Idempotency-Key on the titration step and the custom symptom

2026-09-10 07:40:05 +02:00

medications-intake-bulk.test.ts

fix(medications): scope the intake idempotency key to its owner

2026-07-25 18:41:40 +02:00

mfa-login-flow.test.ts

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00

mock-next-headers.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

mood-a1-backfill.test.ts

feat(mood): map existing entries onto the pleasantness scale

2026-08-08 01:03:05 +02:00

mood-backup-round-trip.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

mood-context-linkage.test.ts

fix(mood): the linked day read crosses sections, so it declares record

2026-08-08 09:58:22 +02:00

mood-context.test.ts

fix(api): a bad dimension skips its own bulk entry, as the contract said

2026-08-08 09:58:50 +02:00

mood-dimension-features.test.ts

docs(mood): state the validation's real leak boundary, drop the unused weekday floor, correct two comments

2026-08-08 15:30:38 +02:00

mood-entries-bulk.test.ts

test(mood): align integration fixtures with the curated default catalog

2026-06-14 11:31:52 +02:00

mood-entries-external-id.test.ts

fix(mood): honour externalId for idempotent re-import on the native entry routes

2026-06-05 03:45:04 +02:00

mood-entries-note-column.test.ts

feat(security): add second-factor schema and encrypt free-text health notes at rest

2026-06-27 19:33:10 +02:00

mood-insights-crosstab.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

mood-prognosis-ladder.test.ts

fix(mood): refuse a forecast below the data floor on the read path, not only in the job

2026-08-08 15:30:00 +02:00

mood-tag-groups.test.ts

feat(insights): persist correlation patterns

2026-07-28 14:01:11 +02:00

mood-writers-agree.test.ts

fix(mood): one spelling on the wire, one day-key helper, one written decision

2026-08-08 03:03:38 +02:00

note-encryption-backfill.test.ts

feat(security): add second-factor schema and encrypt free-text health notes at rest

2026-06-27 19:33:10 +02:00

notification-attribution.test.ts

test(02-11): verify final claim uses database time

2026-08-06 13:47:42 +02:00

notification-global-channel-switch.test.ts

test(integration): wait for the ledger row, not for fifty milliseconds

2026-09-11 13:43:19 +02:00

nutrients-batch.test.ts

feat(nutrients): tell the account holder when a sync arrived but nothing landed

2026-07-30 23:30:28 +02:00

offhost-backup-ledger.test.ts

fix(backup): resume an off-host run where its last attempt stopped

2026-09-25 02:05:19 +02:00

offhost-backup-streaming-memory.test.ts

chore(backup): drop the whole-string builder the streaming path replaced

2026-09-05 20:23:08 +02:00

oidc-pending-link.test.ts

fix(auth): link single sign-on to an existing account only after its own sign-in

2026-09-26 16:10:32 +02:00

onboarding-needs.test.ts

Never derive answers given for somebody else onto the guardian

2026-09-10 18:58:21 +02:00

openapi-response-shape.test.ts

test(api): use the real caps in the limiter mocks, and drop a stale pointer

2026-09-10 05:07:15 +02:00

partial-unique-live-rows.test.ts

feat(integrations): remove the moodLog integration

2026-07-25 11:36:18 +02:00

passkey-register.test.ts

fix(auth): require a fresh proof before a second factor is added

2026-09-26 15:55:57 +02:00

pr-detection-cumulative-paged.test.ts

perf(records): find the best cumulative day a day at a time

2026-09-25 02:05:19 +02:00

pr-detection-end-to-end.test.ts

test(score): pin the weight yardstick, the mood gate and rollup/live parity

2026-07-27 23:15:38 +02:00

practitioner-specialty-search.test.ts

feat(practitioners): search and group the address book by specialty

2026-08-09 06:53:57 +02:00

prisma-schema-name-drift.test.ts

fix(environment): name the enum type the database actually has

2026-07-26 14:37:57 +02:00

provider-token-refresh-serialization.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

queue-singleton-policy.integration.test.ts

Pin the queue policy decisions with tests

2026-07-19 02:31:45 +02:00

rate-limit-429-headers.test.ts

fix(api): dress only the 429s a limiter actually refused

2026-09-10 04:55:19 +02:00

rate-limit.test.ts

test(integration): stop the rate-limit reset test racing its own window

2026-09-09 22:55:53 +02:00

record-session-epoch-trigger.test.ts

feat(02-12.1): stamp a record-context epoch on every session

2026-08-06 17:52:10 +02:00

record-session-fence-idempotency.test.ts

test(02-12.1): prove the record-session fence end to end

2026-08-06 19:33:15 +02:00

record-session-fence.test.ts

feat(02-12.1): refuse a record request whose context has moved

2026-08-06 18:21:40 +02:00

record-settings-authorization.test.ts

test(record-settings): hold the module write to the shared helper

2026-09-10 15:35:52 +02:00

refresh-rotation-access-sunset.test.ts

fix(auth): sunset the rotated-away access token instead of revoking it

2026-09-06 15:36:35 +02:00

refresh-rotation-revoke-race.test.ts

fix(auth): sign out the other devices, lose a refresh to a revocation, key the replay cache by authority

2026-09-08 20:23:30 +02:00

reset-password-revocation.test.ts

test(01-03): add atomic reset revocation contracts

2026-07-29 13:42:04 +02:00

restore-job-driver.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

rollup-concurrent-recompute.test.ts

chore(release): v1.28.33 — re-importing a cumulative Apple Health export works again

2026-07-14 11:56:29 +02:00

rollup-regression-parity.integration.test.ts

fix(rollups): rebase regression x-axis to a fixed origin for exact accumulators

2026-06-26 13:24:30 +02:00

server-cache-routes.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

session-cookie-validation.test.ts

test(oidc): cover the session resolver behind the duplicate-callback path

2026-07-23 15:16:48 +02:00

sessions-and-known-devices.test.ts

fix(auth): sign out the other devices, lose a refresh to a revocation, key the replay cache by authority

2026-09-08 20:23:30 +02:00

settings-account-delete.test.ts

chore(release): v1.4.45 — analytics 9 s perf fix + audit-marathon closure + v1.4.44 hotfix merged

2026-05-21 23:13:21 +02:00

settings-data-wipe.test.ts

Retire the five-step wizard's route, goals and columns

2026-09-10 15:32:35 +02:00

settings-erasure-bearer-step-up.test.ts

auth: let a token prove a second factor for erasure

2026-09-02 11:51:09 +02:00

setup.ts

test(integration): retry a truncate that lost a deadlock

2026-09-11 12:38:31 +02:00

share-link-documents.test.ts

test(share-links): drop the unused owner binding in the ownership guard

2026-07-07 22:00:14 +02:00

sharing-account-access.test.ts

test(sharing): carry the two domain lists through the account-access contract

2026-09-09 20:06:48 +02:00

sharing-audit-actor.test.ts

Harden the guards that could go green for the wrong reason

2026-08-14 02:33:07 +02:00

sharing-delegable-routes.test.ts

Let the GLP-1 read reach the record its own write already reaches

2026-08-22 13:04:33 +02:00

sharing-delegable-writes.test.ts

feat: open the anamnesis record surface to managers

2026-08-07 00:01:27 +02:00

sharing-front-door.test.ts

feat(ai): show stored model text inside a shared record as the owner would

2026-09-24 10:17:00 +02:00

sharing-idempotency-revocation.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-import-attribution.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-lifecycle.test.ts

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-manage-handler-matrix.test.ts

Register the skip and snooze admissions in the MANAGE handler matrix

2026-08-14 14:27:58 +02:00

sharing-provider-origin.test.ts

test(sharing): read the real assistant switches in the provider-origin checks

2026-09-24 10:32:41 +02:00

sharing-scope-fence.test.ts

test(sharing): wait for the refusal audit row instead of guessing

2026-09-02 13:01:23 +02:00

sharing-scope-routes.test.ts

feat: add scoped record invitations

2026-08-05 23:58:30 +02:00

sleep-entry-hours-round-trip.test.ts

fix(measurements): store a hand-entered night in the unit the field asks for

2026-08-07 14:30:10 +02:00

soft-delete-copy-parity.test.ts

test(settings): prove the wipe against real Postgres, and state what deletion means

2026-07-26 14:04:44 +02:00

source-aware-rollups.integration.test.ts

feat(rollups): collapse overlapping sources across all read paths

2026-06-04 10:05:47 +02:00

source-priority-two-axis.test.ts

fix(analytics): restore device-priority sleep selection

2026-07-29 16:08:41 +02:00

step-consolidation-repair.test.ts

fix(measurements): legacy step consolidation no longer sweeps provider daily totals

2026-07-15 22:49:07 +02:00

step-up-elevation.test.ts

Let a passkey satisfy the passkey-removal step-up

2026-08-23 17:44:13 +02:00

stored-backup-read.ts

fix(backup): store a backup in sealed pieces instead of one value

2026-09-26 01:02:48 +02:00

summaries-pre-window-buckets.test.ts

fix(analytics): count each reading once in the all-time summaries

2026-09-25 14:10:56 +02:00

switched-session-destructive-refusal.test.ts

docs(api): publish the switch refusal on the wipe, the deletion and the encrypted export

2026-09-10 10:49:12 +02:00

sync-changes.test.ts

Anchor the sync fixtures on a relative clock

2026-08-03 10:34:48 +02:00

sync-state.test.ts

Move the contract tests to the end that now writes

2026-08-02 02:00:08 +02:00

timezone-per-user.test.ts

fix(charts): cut days in the account's zone when a mount passes none

2026-09-24 08:15:16 +02:00

user-avatar.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

vaccination-booster-mint.test.ts

feat(vaccinations): mint the booster reminder a logged dose suggests

2026-08-08 21:01:25 +02:00

vaccination-booster-satisfy.test.ts

feat(vaccinations): let a logged dose clear the boosters it answers

2026-08-08 14:36:08 +02:00

vaccination-booster-scoped-delegate.test.ts

fix(vaccinations): keep the booster mint inside the sections the grant opens

2026-09-10 11:11:38 +02:00

vaccination-managed-profile.test.ts

test(vaccinations): prove the managed-profile and scoped-grant record paths

2026-08-08 23:00:39 +02:00

vaccination-renewal.test.ts

feat(vaccinations): show the planned booster's renewal state on the log

2026-09-24 09:44:51 +02:00

whoop-connect-ticket.test.ts

feat(whoop): native-scheme connect redirect and Bearer connect ticket

2026-06-05 08:10:13 +02:00

whoop-owner-identity.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

wipe-seeder.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

withings-activity-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

withings-oauth-flow.test.ts

test(withings): expect the no-credentials connect to redirect, not 400

2026-07-18 02:30:33 +02:00

withings-oauth.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

withings-sleep-stage-composite.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

withings-sleep-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

workout-batch-create.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

workout-batch-enrich.test.ts

test(workouts): pin the losing side of a concurrent enrichment

2026-08-08 09:53:09 +02:00

workout-batch-race.test.ts

release: v1.32.0 — hardening and scalability (#580)

2026-07-22 04:14:15 +02:00

workout-detail-hr-series.test.ts

test(integration): keep the HR-curve fixture inside the retention horizon

2026-08-13 10:25:39 +02:00

workout-insight-claim.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00