Marc-André Bombeck e1718e3c30 fix(auth): count a second-factor attempt before verifying it ...

The login challenge read its attempt count, verified the factor, and only
then incremented. Requests sent in parallel all read the same count below
the cap, so one ticket allowed more guesses than the cap. Each attempt is
now reserved by a single guarded UPDATE before the factor is evaluated,
and a failure only settles the reserved attempt.

2026-09-26 15:21:42 +02:00

..

api

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00

helpers

fix(backup): make rotation, concurrent writes and old rows safe for pieces

2026-09-26 01:49:02 +02:00

account-payload-consumer-guard.test.ts

feat(ai): publish capabilities on the account payload

2026-09-24 07:49:14 +02:00

acting-account-boundary-guard.test.ts

fix(02-12.1): check record context before an idempotent replay

2026-08-06 18:54:20 +02:00

admin-data-wipe-completeness.test.ts

fix(admin): wipe every account's data, not nine tables

2026-08-08 01:05:31 +02:00

ai-capability-surface-guard.test.ts

refactor(web): retire the feature-flag reader for the capability map

2026-09-24 11:05:59 +02:00

ai-consent-enforcement-guard.test.ts

Merge release/v1.39.0 into feat/ai-routes-insights-coach

2026-09-24 10:16:53 +02:00

ai-egress-capability-guard.test.ts

refactor(ai): re-check every chokepoint through the one egress helper

2026-09-24 09:29:00 +02:00

ai-gateway-csp-unchanged.test.ts

test(ai): pin the gateway provider's isolation and host policy

2026-07-26 22:27:48 +02:00

ai-input-invalidation-guard.test.ts

fix(ai): refresh the account's AI answer after every change to its inputs

2026-09-24 12:11:14 +02:00

api-errors-leaf-guard.test.ts

Keep the leaf-guard regexes inside the compiler's target

2026-08-14 02:34:40 +02:00

apple-health-unit-audit-guard.test.ts

test: ban a length rescale, not every literal thousand

2026-09-10 00:37:22 +02:00

background-task-settle-guard.test.ts

fix(test): stop the score suites from talking to a real database

2026-09-09 22:39:39 +02:00

backup-plan-classification.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

backup-readers-stream-guard.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

bearer-scope-enforcement-guard.test.ts

fix(documents): keep every import key deleted, answer re-sends cheaply

2026-09-25 22:35:11 +02:00

client-random-id-guard.test.ts

Make uploads and every other write work over plain HTTP

2026-09-05 16:22:39 +02:00

coach-stream-lifecycle-guard.test.ts

coach: reopen an interrupted conversation with a visible retry

2026-08-13 06:16:45 +02:00

coach-usage-owner-columns-guard.test.ts

docs(ai): drop planning vocabulary from the ledger comments

2026-09-11 12:37:54 +02:00

column-reader-audit-matcher.test.ts

fix(audit): teach the column sweep to tell a filter from a write

2026-09-03 05:09:00 +02:00

compose-env-whitelist-guard.test.ts

test: gate every env read against the compose whitelist

2026-09-03 02:13:02 +02:00

copy-matches-behaviour-guard.test.ts

fix(settings): say precisely what withdrawing AI consent stops and deletes

2026-09-24 12:20:14 +02:00

customize-shortcut-guard.test.ts

fix(sharing): show a guardian the controls the routes accept (#939)

2026-09-09 19:42:27 +02:00

cycle-verdict-guard-defeat.test.ts

Prove the verdict reaches a client and that nothing recomputes it

2026-08-01 10:45:24 +02:00

cycle-verdict-single-decider-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

daily-reads-refetch-guard.test.ts

Pair every daily-read invalidation with its inactive refetch

2026-08-13 18:48:10 +02:00

dashboard-summary-read-plan-guard.test.ts

test: pin the dashboard summary read shapes against a plan regression

2026-09-03 01:47:52 +02:00

dashboard-tile-eligibility-bucket-guard.test.ts

test: guard tile eligibility against a missing null arm

2026-09-09 23:03:38 +02:00

data-wipe-completeness.test.ts

Hygiene: name the FHIR immunization gap, cache the digest offline, freeze the no-FK pair, document the pin bump

2026-08-14 09:56:45 +02:00

database-pin-is-watched.test.ts

chore(deps): keep PostgreSQL majors out of the update stream

2026-09-16 13:05:14 +02:00

date-order-explicit-formatter-guard.test.ts

fix(format): carry the date-order preference to every numeric date

2026-09-05 17:06:34 +02:00

dense-measurement-read-guard.test.ts

fix(cycle): read the phase crosstab as per-source day aggregates

2026-09-24 08:06:47 +02:00

dependency-override-lockstep-guard.test.ts

test: read every spelling of a dependency override pin

2026-09-03 01:42:16 +02:00

derived-response-consumer-guard.test.ts

feat(ai): serve Insights and Coach data whatever AI says

2026-09-24 09:19:36 +02:00

derived-wellness-value-contract.test.ts

feat(insights): let a caller choose the derived-metric window

2026-08-24 02:00:55 +02:00

destructive-control-guard.test.ts

settings: move the About-me note and free-text allergies into the Anamnese

2026-08-13 06:16:45 +02:00

discovery-matrix-guard.test.ts

fix(insights): scan one discovery matrix from every correlation surface

2026-08-23 17:38:14 +02:00

display-transform-rounding-guard.test.ts

fix: complete dashboard hydration

2026-08-05 23:03:17 +02:00

doctor-report-control-gating-guard.test.ts

feat(doctor-report): add a surgical history section

2026-09-25 08:11:42 +02:00

domain-write-support-guard.test.ts

docs(sharing): say that the writable-section list is existential, not per verb

2026-09-10 11:16:55 +02:00

dynamic-key-exhaustiveness.test.ts

fix(i18n): make the Korean locale actually work end to end

2026-08-26 20:00:44 +09:00

e2e-measurement-gating-guard.test.ts

test: allowlist the consent journey's origin-only goto

2026-09-15 14:39:09 +02:00

e2e-route-cleanup-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

e2e-shared-session-guard.test.ts

test(e2e): give the account-switching journey its own session

2026-08-02 16:49:47 +02:00

encounter-reminder-exclusion.test.ts

fix(reminders): keep an open check-up due after its reminder

2026-09-26 10:01:27 +02:00

error-code-catalogue.test.ts

fix(api): read every module a route reaches when listing the error codes

2026-09-10 08:31:44 +02:00

external-id-stability-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

feature-flags-mock-guard.test.ts

test(ai): refuse feature-flags mocks that leave the loader's reader out

2026-09-24 10:52:04 +02:00

greeting-hour-single-source.test.ts

fix(dashboard): give the time-of-day greeting one clock

2026-09-03 05:49:18 +02:00

guardian-notification-payloads.test.ts

feat(02-11): secure guardian notification delivery

2026-08-06 05:44:41 +02:00

guardian-notification-policy.test.ts

feat: add guardian notification fanout

2026-08-06 05:23:38 +02:00

health-score-basis-additive-contract.test.ts

test(score): turn the eligibility pins from a floor into a tier

2026-08-30 14:16:33 +02:00

i18n-call-site-coverage.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

i18n-drift-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

i18n-english-leak-guard.test.ts

Translate the setup flow into the other six locales

2026-09-10 15:47:22 +02:00

i18n-reference-matcher.test.ts

fix(i18n): stop one key template from whitelisting a whole namespace

2026-07-25 16:23:58 +02:00

i18n-reverse-coverage.test.ts

feat(insights): serve status notes from the new table, only while available

2026-09-24 09:06:22 +02:00

idempotency-contract-publication.test.ts

fix(backup): refuse a stored copy that will not open with 422

2026-09-10 05:25:30 +02:00

insights-unit-literal-guard.test.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

intake-toast-single-decision.test.ts

Close the delegated-access gaps the release audit left open

2026-08-04 14:55:32 +02:00

integration-callback-url-guard.test.ts

Resolve OAuth callback URLs on the server for integration cards

2026-09-01 21:00:12 +02:00

integration-failure-response-consumer-guard.test.ts

test(api): guard response field consumers

2026-07-28 21:05:42 +02:00

integration-truncate-deadlock-retry.test.ts

test(integration): retry a truncate that lost a deadlock

2026-09-11 12:38:31 +02:00

inventory-write-isolation.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

job-locale-resolution-guard.test.ts

Resolve job-side locale through the operator default

2026-09-02 10:44:04 +02:00

malformed-json-status-guard.test.ts

fix(api): answer an unparseable body with 400 everywhere

2026-09-10 07:26:32 +02:00

manage-activity-inventory.test.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

managed-profile-contract.test.ts

docs: publish the last-Guardian refusal where it is actually raised

2026-08-07 05:43:06 +02:00

managed-record-navigation.test.tsx

fix(settings): list record content only where the grant manages it

2026-09-13 14:49:56 +02:00

measurement-backup-completeness.test.ts

fix(insights): scope generation guard to prompt fields, clear cache on restore

2026-07-28 21:11:43 +02:00

measurement-source-label-coverage.test.ts

Fail the suite when a source enum member has no label

2026-09-02 12:08:38 +02:00

measurement-write-plausibility-guard.test.ts

Merge branch 'feat/restore-background-job' into release/v1.39.1

2026-09-25 08:10:06 +02:00

medication-intake-tracking-guard.test.ts

fix(medications): leave record-only doses out of the nudge, the status model and the BP correlation

2026-09-25 10:03:08 +02:00

medications-efficacy-verb-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

migration-number-uniqueness.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

module-gate-record-scoped.test.ts

fix(modules): drop the last three fail-open gates and discover the class instead of naming it

2026-09-10 12:14:14 +02:00

mood-backup-completeness.test.ts

feat(backup): carry the mood day context through export and restore

2026-08-08 07:14:04 +02:00

mood-prediction-write-surface-guard.test.ts

docs(mood): state the validation's real leak boundary, drop the unused weekday floor, correct two comments

2026-08-08 15:30:38 +02:00

moodlog-removal-guard.test.ts

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

narrated-locale-guard-defeat.test.ts

Close four ways around the locale guard

2026-07-31 11:08:06 +02:00

narrated-locale-required-guard.test.ts

Pin the Coach read strip's language, and keep the default out

2026-07-31 09:07:50 +02:00

notification-delivery-identity.test.ts

fix(02-11): release guardian lock before provider egress

2026-08-06 13:46:42 +02:00

openapi-account-sharing-components.test.ts

docs(api): publish the sharing request bodies as named schemas

2026-08-07 08:10:48 +02:00

openapi-route-coverage-guard.test.ts

Merge the notification dispatch end-to-end journey, the account-scoped reminder sweep and the published notification preferences

2026-09-10 06:37:56 +02:00

openapi-security-declaration-guard.test.ts

feat(api): publish retirement in the contract, the capability read, and the coverage guard

2026-08-23 14:06:52 +02:00

openapi-sharing-denial.test.ts

fix(modules): drop the last three fail-open gates and discover the class instead of naming it

2026-09-10 12:14:14 +02:00

prefetch-page-caching-guard.test.ts

Enrol the two new prefetching pages in their structural guards

2026-08-13 19:11:57 +02:00

prisma-enum-mapping-guard.test.ts

fix(environment): name the enum type the database actually has

2026-07-26 14:37:57 +02:00

profile-email-rate-limit-contract.test.ts

Narrow a spent email budget to the field, and record both refusals

2026-09-11 14:36:58 +02:00

profile-rejection-surface-guard.test.ts

docs: comments name what the code does, not how it was built

2026-09-11 11:03:04 +02:00

proxy-csp-blob-preview.test.ts

Let the app CSP frame and render its own blob previews

2026-08-13 12:08:59 +02:00

proxy-csp-hsts-hardening.test.ts

chore: scrub instance details and personal data from committed artefacts

2026-06-10 11:00:26 +02:00

proxy-demo-mode-allowlist.test.ts

fix(demo): the shared demo account takes no free text and no new record

2026-09-11 10:57:42 +02:00

proxy-document-serve-framing.test.ts

feat(share-links): attach documents and serve them through the share token

2026-07-07 18:43:13 +02:00

proxy-early-exit-headers.test.ts

fix(nutrients): bound the manual water writes and put nutrient totals in the backup

2026-07-19 13:40:03 +02:00

proxy-invite-public.test.ts

fix(auth): the invite landing redirects at the edge, no shell, no race

2026-09-11 09:09:46 +02:00

proxy-mcp-authorize-csp.test.ts

fix(mcp): let the consent screen return to the connecting client

2026-09-15 14:06:27 +02:00

proxy-onboarding-redirect.test.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

proxy-page-marker.test.ts

fix(pwa): let the service worker leave an origin HealthLog left

2026-09-13 14:00:11 +02:00

proxy-page-no-store.test.ts

fix(proxy): pin no-store on every session-gated page

2026-07-19 10:59:40 +02:00

proxy-privacy-public.test.ts

chore(release): v1.4.26 — privacy policy for App Store submission

2026-05-15 07:35:05 +02:00

proxy-relative-redirect-guard.test.ts

Stop redirecting to the address the process bound to

2026-08-22 10:55:40 +02:00

proxy-retired-routes.test.ts

feat(api): answer a retired route with 410 rather than a bare 404

2026-08-23 14:06:37 +02:00

proxy-well-known-public.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

proxy-worker-health.test.ts

fix(runtime): harden process startup and health

2026-07-21 00:05:03 +02:00

published-env-reaches-the-container.test.ts

fix: close two gaps the last audit round left open

2026-08-07 02:26:29 +02:00

record-fence-headerless-transport-guard.test.ts

test(sharing): read loadDocument as a headerless navigation sink

2026-09-24 10:57:45 +02:00

record-session-fence-acceptance-map.test.ts

test(02-12.1): prove Vary on the serving path, not only the contents

2026-08-06 23:04:29 +02:00

record-session-fence-compat.test.ts

feat(02-12.1): carry and verify the record context from the browser

2026-08-06 19:10:02 +02:00

record-session-fence-guard.test.ts

docs(02-12.1): narrow two overstated claims

2026-08-06 20:48:50 +02:00

record-settings-configuration.test.ts

feat: gate a switched browser on the record's modules, not the actor's

2026-09-10 00:02:03 +02:00

record-settings-contract.test.ts

fix(settings): a fresh managed connection reads as connected again

2026-09-11 10:54:56 +02:00

record-settings-route-guard.test.ts

fix: complete managed record settings

2026-08-06 03:40:13 +02:00

record-settings-ui.test.tsx

feat(i18n): add Korean as a seventh end-to-end locale

2026-08-26 16:42:45 +09:00

record-write-rate-limit-contract.test.ts

fix(api): give the shared write ceiling a code a client can branch on

2026-09-10 08:39:09 +02:00

report-selection-egress-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

rotation-walk-keyset-guard.test.ts

fix(crypto): page the key-rotation walks by id, not by cursor

2026-09-25 09:17:25 +02:00

service-worker-version-anchor.test.ts

fix(sw): re-anchor the fallback cache version and gate it against the release

2026-07-30 11:55:16 +02:00

service-worker.test.ts

fix(pwa): keep a subscribed worker registered behind a gateway

2026-09-13 14:45:31 +02:00

session-surface-guard.test.ts

fix(auth): the refusal code joins the published catalogue

2026-09-11 09:51:32 +02:00

share-view-leaf-render-guard.test.ts

feat(doctor-report): add a surgical history section

2026-09-25 08:11:42 +02:00

shared-record-navigation.test.tsx

feat: let the record's module map filter its own navigation

2026-09-10 01:09:50 +02:00

sharing-accessibility-states.test.tsx

test: wire every release journey to the tests that carry it

2026-08-07 06:11:36 +02:00

sharing-boundary-copy.test.ts

fix(i18n): make the Korean locale actually work end to end

2026-08-26 20:00:44 +09:00

sharing-legacy-client-contract.test.ts

refactor(sharing): retire the coarse "may this person add" answer

2026-09-10 11:02:32 +02:00

sharing-native-client-contract.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

sharing-record-fence-contract.test.ts

test: enforce sharing client step-up

2026-08-07 05:11:02 +02:00

sharing-recoverable-errors.test.tsx

test(sharing): follow the invite form's new scope default and one-line copy

2026-08-08 21:20:57 +02:00

sharing-scope-contract.test.ts

feat: define scoped sharing levels

2026-08-05 23:58:18 +02:00

sharing-surface-guard.test.ts

feat(body-sites): record a body site on conditions and add a body-site view

2026-09-25 21:55:14 +02:00

step-up-elevation-guard.test.ts

auth: let a token prove a second factor for erasure

2026-09-02 11:51:09 +02:00

success-affordance-guard.test.ts

fix(medications): refetch the daily reads after the track-intake switch

2026-09-25 09:15:18 +02:00

sw-security-hardening.test.ts

test(01-02): add red PWA cache isolation contracts

2026-07-29 13:37:20 +02:00

timezone-explicit-formatter-guard.test.ts

fix(tz): close the hole that let a display option pass for a timezone

2026-07-27 16:10:30 +02:00

unguarded-correlation-guard.test.ts

fix(insights): gate the mood correlation cards on significance

2026-09-03 02:07:29 +02:00

unit-preference-display-guard.test.ts

Read the height-surface guard across a split form

2026-09-09 23:29:00 +02:00

unit-suite-browser-install-guard.test.ts

ci: give every job that runs the unit suite a browser

2026-09-09 22:47:31 +02:00

v137-wave-zero-fixtures.test.ts

Show the answers behind a screening score

2026-08-14 09:46:48 +02:00

v1341-locale-parity.test.ts

refactor(web): retire the feature-flag reader for the capability map

2026-09-24 11:05:59 +02:00

v1391-additive-contract.test.ts

test(contract): pin the v1.39.1 wire changes as additive for shipped clients

2026-09-25 07:39:07 +02:00

vorsorge-due-bucket-single-home-guard.test.ts

fix(checkups): say "overdue since yesterday" instead of "overdue by 1 days"

2026-09-26 10:01:04 +02:00

weight-tile-direction-guard.test.ts

feat(weight): judge the weight trend against the stored target

2026-09-24 09:22:50 +02:00

workout-canonical-identity-guard.test.ts

test(guards): sweep the directories the structural guards were skipping

2026-08-02 16:21:19 +02:00

workout-sport-provenance-guard.test.ts

feat(backup): run a restore as a background job with progress

2026-09-25 07:39:06 +02:00

written-outcome-response-consumer-guard.test.ts

feat(labs): keep the reference range a report prints beside a value

2026-08-07 21:40:41 +02:00

zod-refusal-issue-list-guard.test.ts

fix(api): answer the unknown-leaf refusal with a sentence and a code

2026-09-10 08:35:35 +02:00