mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André Bombeck
12f4bc24e8
The Coach can append a ---SUGGEST-REMINDER--- sentinel to propose a measurement cadence (weight daily, the ESH/AHA 7-2-2 home-BP protocol, structured glucose). The server resolves the cadence from a closed catalog and emits an additive 'suggestion' SSE frame the chat renders as a one-tap action card; accepting it creates a MeasurementReminder with origin COACH through the same engine the Vorsorge surface uses (server-authoritative schedule, finite course window self-expires via endsOn). Non-naggy by construction: a frequency-cap cooldown, dismissal memory, a master opt-out under Coach settings, and an explicit 'I measure enough' stop path, all in the coach-prefs blob. Triple dedup at suggest, render, and create so a cadence is never double-suggested or double-created, and suggestions for a disabled module never surface. RHR/HRV stay passive -- the Coach surfaces the baseline, it never nudges to 'go measure' them. The reminder DTO now echoes origin and endsOn for the iOS client.
37 lines
1.5 KiB
TOML
37 lines
1.5 KiB
TOML
# Gitleaks configuration. Extends the built-in default ruleset and adds
|
|
# a project-specific allowlist for false-positives that gitleaks 8.x flags
|
|
# as "generic-api-key" inside test fixtures.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Project-wide ignores for test fixtures and known non-secret tokens"
|
|
|
|
paths = [
|
|
# All test files contain hardcoded fake tokens / idempotency-keys.
|
|
'''(^|/)__tests__/''',
|
|
'''\.test\.ts$''',
|
|
# OpenAPI spec contains example tokens (`hlk_example…`) used to document the schema.
|
|
'''^docs/api/openapi\.yaml$''',
|
|
]
|
|
|
|
# Substring matches — anything matching is treated as non-secret regardless of file.
|
|
regexes = [
|
|
# Idempotency-Key request-header values are random UUIDs / opaque strings,
|
|
# not secrets. The header name itself just trips the generic-api-key rule.
|
|
'''idempotency-key''',
|
|
# Allow the placeholder prefix used in OpenAPI examples + docs.
|
|
'''hlk_example''',
|
|
# i18n caption keys for the briefing-driven trend charts are dotted message
|
|
# keys, not secrets — one trips the generic-api-key entropy heuristic.
|
|
'''insights\.trendsRow\.caption''',
|
|
# Coach cadence-suggestion label keys are dotted message keys, not secrets;
|
|
# one trips the generic-api-key entropy heuristic.
|
|
'''coach\.reminderSuggestion\.cadence''',
|
|
]
|
|
|
|
# Specific commit fingerprints from prior false-positive findings (kept for reproducibility).
|
|
# Empty by default; populate via `gitleaks detect --report-path` if a future regression
|
|
# triggers the same false-positive on a stable commit hash.
|
|
stopwords = []
|