Marc-André Bombeck 0fc83cb0a1 fix(auth): ask for a fresh proof before the record or a credential to it leaves ...

Exporting the whole record, making a clinician share link, minting a token,
and the admin backup download, upload and restore, data wipe and password
reset ran on a live session alone. The plaintext full backup did, while the
encrypted one beside it asked for a second factor. Whoever held a stolen
session could take the record, or leave behind a credential that outlives
the session.

These now go through one gate, requireRecentProof (assertRecentCookieProof
for the routes that resolve their caller themselves). A browser session
passes after a sign-in or re-proof within five minutes: a second factor on
an account that has one, otherwise the password or a passkey. The refusal is
401 auth.reproof.required with meta.methods, and the web opens the re-proof
dialog, posts the proof to the new POST /api/auth/reproof and retries. A
password proof stamps the new Session.reproofAt (migration 0359), never
mfaVerifiedAt, so it cannot stand in for a second factor anywhere.

On Bearer, the full backup asks for an X-Step-Up elevation; the encrypted
export asks for a second-factor elevation on an account that has one. Share
links and connector tokens keep taking the token alone, because the shipped
app calls them without an elevation and reads a 401 there as a dead
session; the guard test names them.

Key rotation keeps its stricter second-factor gate.

2026-09-26 19:54:38 +02:00

..

api

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00

helpers

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

account-payload-consumer-guard.test.ts

feat(ai): publish capabilities on the account payload

2026-09-24 07:49:14 +02:00

acting-account-boundary-guard.test.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

admin-data-wipe-completeness.test.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

ai-capability-surface-guard.test.ts

refactor(web): retire the feature-flag reader for the capability map

2026-09-24 11:05:59 +02:00

ai-consent-enforcement-guard.test.ts

Merge release/v1.39.0 into feat/ai-routes-insights-coach

2026-09-24 10:16:53 +02:00

ai-egress-capability-guard.test.ts

refactor(ai): re-check every chokepoint through the one egress helper

2026-09-24 09:29:00 +02:00

ai-gateway-csp-unchanged.test.ts

test(ai): pin the gateway provider's isolation and host policy

2026-07-26 22:27:48 +02:00

ai-input-invalidation-guard.test.ts

fix(ai): refresh the account's AI answer after every change to its inputs

2026-09-24 12:11:14 +02:00

api-errors-leaf-guard.test.ts

Keep the leaf-guard regexes inside the compiler's target

2026-08-14 02:34:40 +02:00

api-handler-bypass-route.test.ts

fix(http): stop reading request bodies of up to 512 MB before authentication

2026-09-26 16:31:03 +02:00

apple-health-unit-audit-guard.test.ts

test: ban a length rescale, not every literal thousand

2026-09-10 00:37:22 +02:00

background-task-settle-guard.test.ts

fix(test): stop the score suites from talking to a real database

2026-09-09 22:39:39 +02:00

backup-plan-classification.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-readers-stream-guard.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

bearer-scope-enforcement-guard.test.ts

fix(documents): keep every import key deleted, answer re-sends cheaply

2026-09-25 22:35:11 +02:00

client-random-id-guard.test.ts

Make uploads and every other write work over plain HTTP

2026-09-05 16:22:39 +02:00

coach-stream-lifecycle-guard.test.ts

coach: reopen an interrupted conversation with a visible retry

2026-08-13 06:16:45 +02:00

coach-usage-owner-columns-guard.test.ts

docs(ai): drop planning vocabulary from the ledger comments

2026-09-11 12:37:54 +02:00

column-reader-audit-matcher.test.ts

fix(audit): teach the column sweep to tell a filter from a write

2026-09-03 05:09:00 +02:00

compose-env-whitelist-guard.test.ts

test: gate every env read against the compose whitelist

2026-09-03 02:13:02 +02:00

copy-matches-behaviour-guard.test.ts

fix(settings): say precisely what withdrawing AI consent stops and deletes

2026-09-24 12:20:14 +02:00

customize-shortcut-guard.test.ts

fix(sharing): show a guardian the controls the routes accept (#939)

2026-09-09 19:42:27 +02:00

cycle-verdict-guard-defeat.test.ts

Prove the verdict reaches a client and that nothing recomputes it

2026-08-01 10:45:24 +02:00

cycle-verdict-single-decider-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

daily-reads-refetch-guard.test.ts

Pair every daily-read invalidation with its inactive refetch

2026-08-13 18:48:10 +02:00

dashboard-summary-read-plan-guard.test.ts

test: pin the dashboard summary read shapes against a plan regression

2026-09-03 01:47:52 +02:00

dashboard-tile-eligibility-bucket-guard.test.ts

test: guard tile eligibility against a missing null arm

2026-09-09 23:03:38 +02:00

data-wipe-completeness.test.ts

Hygiene: name the FHIR immunization gap, cache the digest offline, freeze the no-FK pair, document the pin bump

2026-08-14 09:56:45 +02:00

database-pin-is-watched.test.ts

chore(deps): keep PostgreSQL majors out of the update stream

2026-09-16 13:05:14 +02:00

date-order-explicit-formatter-guard.test.ts

fix(format): carry the date-order preference to every numeric date

2026-09-05 17:06:34 +02:00

dense-measurement-read-guard.test.ts

fix(cycle): read the phase crosstab as per-source day aggregates

2026-09-24 08:06:47 +02:00

dependency-override-lockstep-guard.test.ts

test: read every spelling of a dependency override pin

2026-09-03 01:42:16 +02:00

derived-response-consumer-guard.test.ts

feat(ai): serve Insights and Coach data whatever AI says

2026-09-24 09:19:36 +02:00

derived-wellness-value-contract.test.ts

feat(insights): let a caller choose the derived-metric window

2026-08-24 02:00:55 +02:00

destructive-control-guard.test.ts

settings: move the About-me note and free-text allergies into the Anamnese

2026-08-13 06:16:45 +02:00

discovery-matrix-guard.test.ts

fix(insights): scan one discovery matrix from every correlation surface

2026-08-23 17:38:14 +02:00

display-transform-rounding-guard.test.ts

fix: complete dashboard hydration

2026-08-05 23:03:17 +02:00

doctor-report-control-gating-guard.test.ts

feat(doctor-report): add a surgical history section

2026-09-25 08:11:42 +02:00

domain-write-support-guard.test.ts

docs(sharing): say that the writable-section list is existential, not per verb

2026-09-10 11:16:55 +02:00

dynamic-key-exhaustiveness.test.ts

fix(i18n): make the Korean locale actually work end to end

2026-08-26 20:00:44 +09:00

e2e-measurement-gating-guard.test.ts

test: allowlist the consent journey's origin-only goto

2026-09-15 14:39:09 +02:00

e2e-route-cleanup-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

e2e-shared-session-guard.test.ts

test(e2e): give the account-switching journey its own session

2026-08-02 16:49:47 +02:00

encounter-reminder-exclusion.test.ts

fix(reminders): keep an open check-up due after its reminder

2026-09-26 10:01:27 +02:00

error-code-catalogue.test.ts

fix(api): read every module a route reaches when listing the error codes

2026-09-10 08:31:44 +02:00

external-id-stability-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

factor-verification-surface-guard.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

feature-flags-mock-guard.test.ts

test(ai): refuse feature-flags mocks that leave the loader's reader out

2026-09-24 10:52:04 +02:00

greeting-hour-single-source.test.ts

fix(dashboard): give the time-of-day greeting one clock

2026-09-03 05:49:18 +02:00

guardian-notification-payloads.test.ts

feat(02-11): secure guardian notification delivery

2026-08-06 05:44:41 +02:00

guardian-notification-policy.test.ts

feat: add guardian notification fanout

2026-08-06 05:23:38 +02:00

health-score-basis-additive-contract.test.ts

test(score): turn the eligibility pins from a floor into a tier

2026-08-30 14:16:33 +02:00

i18n-call-site-coverage.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

i18n-drift-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

i18n-english-leak-guard.test.ts

Translate the setup flow into the other six locales

2026-09-10 15:47:22 +02:00

i18n-reference-matcher.test.ts

fix(i18n): stop one key template from whitelisting a whole namespace

2026-07-25 16:23:58 +02:00

i18n-reverse-coverage.test.ts

feat(insights): serve status notes from the new table, only while available

2026-09-24 09:06:22 +02:00

idempotency-contract-publication.test.ts

fix(backup): refuse a stored copy that will not open with 422

2026-09-10 05:25:30 +02:00

insights-unit-literal-guard.test.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

intake-toast-single-decision.test.ts

Close the delegated-access gaps the release audit left open

2026-08-04 14:55:32 +02:00

integration-callback-url-guard.test.ts

Resolve OAuth callback URLs on the server for integration cards

2026-09-01 21:00:12 +02:00

integration-failure-response-consumer-guard.test.ts

test(api): guard response field consumers

2026-07-28 21:05:42 +02:00

integration-truncate-deadlock-retry.test.ts

test(integration): retry a truncate that lost a deadlock

2026-09-11 12:38:31 +02:00

inventory-write-isolation.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

job-locale-resolution-guard.test.ts

Resolve job-side locale through the operator default

2026-09-02 10:44:04 +02:00

malformed-json-status-guard.test.ts

fix(api): answer an unparseable body with 400 everywhere

2026-09-10 07:26:32 +02:00

manage-activity-inventory.test.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

managed-profile-contract.test.ts

docs: publish the last-Guardian refusal where it is actually raised

2026-08-07 05:43:06 +02:00

managed-record-navigation.test.tsx

fix(settings): list record content only where the grant manages it

2026-09-13 14:49:56 +02:00

measurement-backup-completeness.test.ts

fix(insights): scope generation guard to prompt fields, clear cache on restore

2026-07-28 21:11:43 +02:00

measurement-source-label-coverage.test.ts

Fail the suite when a source enum member has no label

2026-09-02 12:08:38 +02:00

measurement-write-plausibility-guard.test.ts

Merge branch 'feat/restore-background-job' into release/v1.39.1

2026-09-25 08:10:06 +02:00

medication-intake-tracking-guard.test.ts

fix(medications): leave record-only doses out of the nudge, the status model and the BP correlation

2026-09-25 10:03:08 +02:00

medications-efficacy-verb-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

migration-number-uniqueness.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

module-gate-record-scoped.test.ts

fix(modules): drop the last three fail-open gates and discover the class instead of naming it

2026-09-10 12:14:14 +02:00

mood-backup-completeness.test.ts

feat(backup): carry the mood day context through export and restore

2026-08-08 07:14:04 +02:00

mood-prediction-write-surface-guard.test.ts

docs(mood): state the validation's real leak boundary, drop the unused weekday floor, correct two comments

2026-08-08 15:30:38 +02:00

moodlog-removal-guard.test.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

narrated-locale-guard-defeat.test.ts

Close four ways around the locale guard

2026-07-31 11:08:06 +02:00

narrated-locale-required-guard.test.ts

Pin the Coach read strip's language, and keep the default out

2026-07-31 09:07:50 +02:00

notification-delivery-identity.test.ts

fix(02-11): release guardian lock before provider egress

2026-08-06 13:46:42 +02:00

openapi-account-sharing-components.test.ts

docs(api): publish the sharing request bodies as named schemas

2026-08-07 08:10:48 +02:00

openapi-route-coverage-guard.test.ts

Merge the notification dispatch end-to-end journey, the account-scoped reminder sweep and the published notification preferences

2026-09-10 06:37:56 +02:00

openapi-security-declaration-guard.test.ts

feat(api): publish retirement in the contract, the capability read, and the coverage guard

2026-08-23 14:06:52 +02:00

openapi-sharing-denial.test.ts

fix(modules): drop the last three fail-open gates and discover the class instead of naming it

2026-09-10 12:14:14 +02:00

prefetch-page-caching-guard.test.ts

Enrol the two new prefetching pages in their structural guards

2026-08-13 19:11:57 +02:00

prisma-enum-mapping-guard.test.ts

fix(environment): name the enum type the database actually has

2026-07-26 14:37:57 +02:00

profile-email-rate-limit-contract.test.ts

Narrow a spent email budget to the field, and record both refusals

2026-09-11 14:36:58 +02:00

profile-rejection-surface-guard.test.ts

docs: comments name what the code does, not how it was built

2026-09-11 11:03:04 +02:00

proxy-body-limit.test.ts

fix(http): stop reading request bodies of up to 512 MB before authentication

2026-09-26 16:31:03 +02:00

proxy-csp-blob-preview.test.ts

Let the app CSP frame and render its own blob previews

2026-08-13 12:08:59 +02:00

proxy-csp-hsts-hardening.test.ts

chore: scrub instance details and personal data from committed artefacts

2026-06-10 11:00:26 +02:00

proxy-demo-mode-allowlist.test.ts

fix(demo): the shared demo account takes no free text and no new record

2026-09-11 10:57:42 +02:00

proxy-document-serve-framing.test.ts

feat(share-links): attach documents and serve them through the share token

2026-07-07 18:43:13 +02:00

proxy-early-exit-headers.test.ts

fix(nutrients): bound the manual water writes and put nutrient totals in the backup

2026-07-19 13:40:03 +02:00

proxy-invite-public.test.ts

fix(auth): the invite landing redirects at the edge, no shell, no race

2026-09-11 09:09:46 +02:00

proxy-local-ocr-csp.test.ts

fix(http): stop reading request bodies of up to 512 MB before authentication

2026-09-26 16:31:03 +02:00

proxy-mcp-authorize-csp.test.ts

fix(mcp): let the consent screen return to the connecting client

2026-09-15 14:06:27 +02:00

proxy-onboarding-redirect.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

proxy-page-marker.test.ts

fix(pwa): let the service worker leave an origin HealthLog left

2026-09-13 14:00:11 +02:00

proxy-page-no-store.test.ts

fix(proxy): pin no-store on every session-gated page

2026-07-19 10:59:40 +02:00

proxy-privacy-public.test.ts

chore(release): v1.4.26 — privacy policy for App Store submission

2026-05-15 07:35:05 +02:00

proxy-relative-redirect-guard.test.ts

Stop redirecting to the address the process bound to

2026-08-22 10:55:40 +02:00

proxy-retired-routes.test.ts

feat(api): answer a retired route with 410 rather than a bare 404

2026-08-23 14:06:37 +02:00

proxy-well-known-public.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

proxy-worker-health.test.ts

fix(runtime): harden process startup and health

2026-07-21 00:05:03 +02:00

published-env-reaches-the-container.test.ts

fix: close two gaps the last audit round left open

2026-08-07 02:26:29 +02:00

recent-proof-surface-guard.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

record-fence-headerless-transport-guard.test.ts

test(sharing): read loadDocument as a headerless navigation sink

2026-09-24 10:57:45 +02:00

record-session-fence-acceptance-map.test.ts

test(02-12.1): prove Vary on the serving path, not only the contents

2026-08-06 23:04:29 +02:00

record-session-fence-compat.test.ts

feat(02-12.1): carry and verify the record context from the browser

2026-08-06 19:10:02 +02:00

record-session-fence-guard.test.ts

docs(02-12.1): narrow two overstated claims

2026-08-06 20:48:50 +02:00

record-settings-configuration.test.ts

feat: gate a switched browser on the record's modules, not the actor's

2026-09-10 00:02:03 +02:00

record-settings-contract.test.ts

fix(settings): a fresh managed connection reads as connected again

2026-09-11 10:54:56 +02:00

record-settings-route-guard.test.ts

fix: complete managed record settings

2026-08-06 03:40:13 +02:00

record-settings-ui.test.tsx

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

record-write-rate-limit-contract.test.ts

fix(api): give the shared write ceiling a code a client can branch on

2026-09-10 08:39:09 +02:00

report-selection-egress-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

rotation-walk-keyset-guard.test.ts

fix(crypto): page the key-rotation walks by id, not by cursor

2026-09-25 09:17:25 +02:00

service-worker-version-anchor.test.ts

fix(sw): re-anchor the fallback cache version and gate it against the release

2026-07-30 11:55:16 +02:00

service-worker.test.ts

fix(pwa): keep a subscribed worker registered behind a gateway

2026-09-13 14:45:31 +02:00

session-surface-guard.test.ts

fix(auth): the refusal code joins the published catalogue

2026-09-11 09:51:32 +02:00

share-view-leaf-render-guard.test.ts

feat(doctor-report): add a surgical history section

2026-09-25 08:11:42 +02:00

shared-record-navigation.test.tsx

feat: let the record's module map filter its own navigation

2026-09-10 01:09:50 +02:00

sharing-accessibility-states.test.tsx

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-boundary-copy.test.ts

fix(i18n): make the Korean locale actually work end to end

2026-08-26 20:00:44 +09:00

sharing-legacy-client-contract.test.ts

refactor(sharing): retire the coarse "may this person add" answer

2026-09-10 11:02:32 +02:00

sharing-native-client-contract.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

sharing-record-fence-contract.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

sharing-recoverable-errors.test.tsx

test(sharing): follow the invite form's new scope default and one-line copy

2026-08-08 21:20:57 +02:00

sharing-scope-contract.test.ts

feat: define scoped sharing levels

2026-08-05 23:58:18 +02:00

sharing-surface-guard.test.ts

feat(body-sites): record a body site on conditions and add a body-site view

2026-09-25 21:55:14 +02:00

step-up-elevation-guard.test.ts

fix(auth): ask for a fresh proof before the record or a credential to it leaves

2026-09-26 19:54:38 +02:00

success-affordance-guard.test.ts

fix(medications): refetch the daily reads after the track-intake switch

2026-09-25 09:15:18 +02:00

sw-security-hardening.test.ts

test(01-02): add red PWA cache isolation contracts

2026-07-29 13:37:20 +02:00

timezone-explicit-formatter-guard.test.ts

fix(tz): close the hole that let a display option pass for a timezone

2026-07-27 16:10:30 +02:00

unguarded-correlation-guard.test.ts

fix(insights): gate the mood correlation cards on significance

2026-09-03 02:07:29 +02:00

unit-preference-display-guard.test.ts

Read the height-surface guard across a split form

2026-09-09 23:29:00 +02:00

unit-suite-browser-install-guard.test.ts

ci: give every job that runs the unit suite a browser

2026-09-09 22:47:31 +02:00

v137-wave-zero-fixtures.test.ts

Show the answers behind a screening score

2026-08-14 09:46:48 +02:00

v1341-locale-parity.test.ts

refactor(web): retire the feature-flag reader for the capability map

2026-09-24 11:05:59 +02:00

v1391-additive-contract.test.ts

test(contract): pin the v1.39.1 wire changes as additive for shipped clients

2026-09-25 07:39:07 +02:00

vorsorge-due-bucket-single-home-guard.test.ts

fix(checkups): say "overdue since yesterday" instead of "overdue by 1 days"

2026-09-26 10:01:04 +02:00

weight-tile-direction-guard.test.ts

feat(weight): judge the weight trend against the stored target

2026-09-24 09:22:50 +02:00

workout-canonical-identity-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

workout-sport-provenance-guard.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

written-outcome-response-consumer-guard.test.ts

feat(labs): keep the reference range a report prints beside a value

2026-08-07 21:40:41 +02:00

zod-refusal-issue-list-guard.test.ts

fix(api): answer the unknown-leaf refusal with a sentence and a code

2026-09-10 08:35:35 +02:00