Marc-André Bombeck 6eef3ab21c fix(workouts): gate the workout read APIs behind the workouts module ...

GET /api/workouts and GET /api/workouts/{id} returned a disabled-
module account's workout list and detail to any valid Bearer or
cookie session. Both now require the workouts module and return the
403 module.disabled envelope when it is off.

The batch INGEST route (POST /api/workouts/batch) stays ungated by
design: synced workouts must keep landing in storage even while the
surface is hidden, so re-enabling the module reveals a complete
history rather than a gap.

2026-06-16 01:57:54 +02:00

..

__tests__

fix(workouts): gate the workout read APIs behind the workouts module

2026-06-16 01:57:54 +02:00

[id]

fix(workouts): gate the workout read APIs behind the workouts module

2026-06-16 01:57:54 +02:00

batch

chore: correct body-cap comments, dockerignore licence posture, stale log copy

2026-06-03 09:10:46 +02:00

route.ts

fix(workouts): gate the workout read APIs behind the workouts module

2026-06-16 01:57:54 +02:00