Marc-André BombeckandClaude Opus 4.7 8e17f227e4 fix(admin): rate-limit /api/admin/backups/run to 3/min per admin ...

pg-boss does not deduplicate by payload, so each click on the manual
"Backup now" button enqueues a fresh data-backup job. Without a
rate-limit, an impatient admin (or compromised admin session via XSS
or token theft) can stack dozens of identical fan-out-per-user jobs
on the queue.

Three runs per minute per admin is plenty for ad-hoc snapshots — the
weekly cron in `reminder-worker` already carries the regular cadence.

Closes H3 from .planning/phase-6-code-review-findings.md (also addresses
M-1 from .planning/phase-6-security-findings.md).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-09 17:42:20 +02:00

..

achievements

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

admin

refactor(v1.5): apply simplify-review safe-to-apply suggestions

2026-05-09 17:41:02 +02:00

api

fix(admin): rate-limit /api/admin/backups/run to 3/min per admin

2026-05-09 17:42:20 +02:00

auth

fix(a11y): close violations the new e2e axe-core sweep surfaced

2026-05-09 16:49:34 +02:00

bugreport

chore(style): repo-wide prettier sweep before v1.4.6 tag

2026-05-09 02:27:17 +02:00

insights

fix(insights): preserve chart visual parity in deferred bundle

2026-05-09 16:41:49 +02:00

measurements

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

medications

release: v1.4.2 — resurrect v1.4.1 work + bug-fix triple (#152)

2026-05-08 17:46:31 +02:00

mood

i18n: migrate from German-first to English-first default locale

2026-03-12 21:31:48 +01:00

notifications

fix(ui): defensive optional chains across summaries/medications/preferences/entries/measurements

2026-05-08 18:36:13 +02:00

onboarding

feat(settings): introduce dynamic-route shell + redirect /settings → /settings/account (#139)

2026-05-08 14:15:15 +02:00

settings

feat(dashboard): single BP tile, equal-height tile strip, settings dashboard/thresholds split

2026-05-08 21:24:30 +02:00

targets

release(v1.2): i18n, thresholds, glucose, dashboard customization, feedback, multi-provider AI (#77)

2026-04-18 22:20:12 +02:00

error.tsx

fix: i18n completeness + UX polish (closes #73, #74) (#75)

2026-04-18 17:15:43 +02:00

favicon.ico

Initial release v1.0.0

2026-03-10 20:14:33 +01:00

global-error.tsx

chore(style): repo-wide prettier sweep before v1.4.6 tag

2026-05-09 02:27:17 +02:00

globals.css

style(ui): use semantic tokens for mood and feedback indicators

2026-05-09 17:18:56 +02:00

layout.tsx

release(v1.2): i18n, thresholds, glucose, dashboard customization, feedback, multi-provider AI (#77)

2026-04-18 22:20:12 +02:00

page.tsx

fix(ui): disambiguate dashboard quick-add menu items

2026-05-09 17:22:08 +02:00

robots.ts

Initial release v1.0.0

2026-03-10 20:14:33 +01:00