mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
Marc-André BombeckandClaude Opus 4.7
a859661686
Extends the device-registration body schema with the paired APNs identity fields the iOS client populates once it has an APNs token from `application:didRegisterForRemoteNotificationsWithDeviceToken:`. Validation rejects half-supplied requests (`apnsToken` without `apnsEnvironment` or vice versa) with 422 and enforces hex format on the token — catching the common iOS implementation bug where the token gets serialised through Swift's `Data.description` (which renders `<deadbeef cafebabe>` with spaces and angle brackets) instead of the hex-join shape Apple's docs spec. The cross-user-hijack guard from CLAUDE.md is duplicated at the APNs-token layer: a registration whose `apnsToken` is already owned by another user returns 409 with reason `apns_token_owned_by_other_user`. APNs tokens aren't secrets, so trusting wire input would let any client who learns one redirect another user's pushes — same threat model as the existing `token` guard, applied to the new field. Audit-log details for `devices.register` now carry `hasApnsToken` and `apnsEnvironment` so admin trails surface APNs pairing events without leaking the raw token. Five new route tests cover the validation + hijack paths (paired-or-omitted, hex regex, create-with-pair, cross-user-409, the original 401/422/409/201 contracts stay green). Ticks STATE.md F4 and lands `.planning/phase-W3-v1423-report.md` covering the six W3 commits. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>