mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-12 06:06:10 +00:00
Marc-André Bombeck
bec7538012
The projection's central claim was carried by a comment. It is now walked before it is returned: any non-numeric leaf at any depth throws, and the only two string leaves are allowlisted by shape — the sport type against the schema enum itself, and the day key against its format. This matters because sport_type is a TEXT column whose API write path is enum-constrained but whose backup-restore path accepts any non-empty string, so a restored row can carry arbitrary text. It is re-asserted at the projection boundary rather than trusted from the column. The heart-rate provenance string is dropped rather than allowlisted, and route geometry stays consumed-not-carried — it yields one number, and location history may not ride a prompt. Own-history rows now collapse cross-source twins through the canonical picker, as the detail page's comparison already did; a session recorded by two paired watches was inflating the sample size and biasing every median.