mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 21:32:18 +00:00
Marc-André Bombeck
f92e644154
Bundles the deferred v1.4.47 Mediums + Lows with the v1.4.48-deferred items into a single release. Headline: server-side suppression of MEDICATION_REMINDER APNs for iOS clients that own their local reminders (closes GH #206), a push_attempts table backing /api/admin/notifications/diagnostic, and a sweep of v1.4.48 QA forward-findings. Performance (the user-visible win): - /api/analytics cold-fallback path splits the heavy single-statement aggregate into two parallel queries. The linearly composable columns (count / min / max / mean) keep the full-partition scan; the windowed 7 / 30 / 90-day avg / slope / r² columns take a 90-day outer cap so the planner does an index range scan on (user_id, type, measured_at) instead of a full-partition sequential scan. Output is bit-identical; cold slim slice drops from multi-second to sub-second on tenants with large measurement partitions. Server-side notifications: - GET + PATCH /api/auth/me/notification-prefs with deep-merge semantics. Initial category medication.clientManaged: boolean (default false). Cron medicationReminderJob skips dose-due APNs when the flag is true, emitting a medication_reminder.suppressed_client_managed wide-event annotation per skip. - push_attempts table backs the diagnostic endpoint. Every APNS / Web-Push / Telegram / NTFY sender writes a fire-and-forget row. Daily 03:35 Europe/Berlin cleanup prunes rows older than 90 days. - /api/admin/notifications/diagnostic — admin-only endpoint surfacing device APNs token presence (masked), channel config presence, and recent push attempts. Registered in OpenAPI. - Per-channel APNs "Send test" button now fires with eventType: "MEDICATION_REMINDER" so the dispatcher's time-sensitive + priority-10 branch runs. A successful self-test now exercises the exact path production reminders take; an unsuccessful one points the user at iOS Settings → Time Sensitive Notifications rather than appearing to be a server-side bug. Withings reliability: - OAuth callback consumes the nonce atomically (delete-first with P2025 catch for the replay branch). The previous read-then-delete pattern allowed a race between two concurrent callbacks. - ?reason=state redirect differentiated into csrf1 / replay / expired / cross_user so operators can tell mismatch types apart without DB shell access. - connect endpoint rate-limited to 10/60s/user; row-create failures redirect to a consistent error surface. Observability hardening: - redactSensitiveFields(body) denylist helper covers password / token / secret / apiKey / authorization / csrfState / nonce, recursive, case-insensitive. Caught: /api/devices invalid_format issues were echoing apnsToken values verbatim into the audit log. - sanitiseZodIssues(issues, { stripValuesFromMessage: true }) overload applied to 14 audit-log sites. Migrations: 0079 (notification_prefs), 0080 (push_attempts). Tests: 4815 → 5272 unit + integration. Workout-batch integration suite that had been red on main since v1.4.45 (three release commits shipped through it) now green again — updated to match v1.4.42 cross-source dedup semantics. Resolves PR #207.
42 lines
1.9 KiB
SQL
42 lines
1.9 KiB
SQL
-- v1.4.49 M-DOUBLE-REMINDER — per-user notification preferences blob.
|
|
--
|
|
-- iOS v0.6.0.7 wires local SpeziScheduler banners for medication doses.
|
|
-- Once the client has confirmed (a) APNs permission = `.authorized`,
|
|
-- (b) Spezi reminders are actively scheduled, and (c) the binary is
|
|
-- >= v0.6.0.7, it flips `notification_prefs.medication.clientManaged`
|
|
-- to true via `PATCH /api/auth/me/notification-prefs`. The server-side
|
|
-- MEDICATION_REMINDER cron then suppresses the redundant APNs push for
|
|
-- that user so the dose only buzzes once.
|
|
--
|
|
-- Shape (additive — future categories slot in next to `medication`):
|
|
-- {
|
|
-- "medication": { "clientManaged": boolean }
|
|
-- }
|
|
--
|
|
-- Default `NULL` (the column itself), which the application layer
|
|
-- resolves to `{ medication: { clientManaged: false } }` so every
|
|
-- existing user keeps the legacy server-side push until the iOS app
|
|
-- explicitly opts them in. This preserves UX for clients that don't
|
|
-- have working local reminders yet (e.g. the
|
|
-- `healthlog-iOS#10` notification-permission-stuck-`notDetermined`
|
|
-- scenario).
|
|
--
|
|
-- Idempotent guard (`IF NOT EXISTS`) matches the 0067 / 0070 / 0071 /
|
|
-- 0075 / 0078 pattern so reruns are safe on prod where the migration
|
|
-- has already been applied.
|
|
--
|
|
-- Reversibility: down migration is
|
|
-- ALTER TABLE "users" DROP COLUMN IF EXISTS "notification_prefs";
|
|
-- A roll-back loses opt-in state for every user that had flipped
|
|
-- `clientManaged` (they fall back to server-side reminders) but the
|
|
-- application reads tolerate a missing column / null row and default
|
|
-- to `clientManaged: false`, so a partial deploy where the schema is
|
|
-- rolled back ahead of the app code keeps working.
|
|
|
|
-- No additional index — reads at cron time are per-user
|
|
-- (`WHERE id = $1`), matching the convention set by
|
|
-- `source_priority_json` and `doctor_report_prefs_json` on the same
|
|
-- table (no GIN index on either).
|
|
ALTER TABLE "users"
|
|
ADD COLUMN IF NOT EXISTS "notification_prefs" JSONB;
|