mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
c8035fdd78
Sixteen routes the native client already calls were absent from the OpenAPI registry, so the published spec said nothing about them. `openapi:check` compares the registry against the YAML and never the routes against the registry, which is why the gap survived. Nightscout status / test / disconnect, the WHOOP credential and status reads, and the Withings status / disconnect pair land in the integrations module. The three per-channel configs under `/api/settings/*` join the settings module; the notification preference and delivery-health surfaces get their own module, as do the MCP connector connections and tokens. These are credential-bearing surfaces, so the contract states what each response actually carries. Every channel GET reduces its secret to a boolean, and the descriptions say so, along with the consequence: a client cannot read the value back, so an empty value on the way in preserves the stored one rather than clearing it. `POST /api/mcp/tokens` is the one operation that returns a usable Bearer, and its description says outright that this is the only copy. Two inline request schemas move to the validations modules they belong in, so the registry documents the same object the handler parses rather than a restatement of it.
19 lines
748 B
TypeScript
19 lines
748 B
TypeScript
import { z } from "zod/v4";
|
|
|
|
/**
|
|
* Body of `POST /api/mcp/tokens` — mint a connector Bearer for the manual /
|
|
* stdio path.
|
|
*
|
|
* `scope` is a closed two-value choice, not a permission list: `read` maps to
|
|
* `["health:read"]` and `read_write` adds `health:write`. The route builds the
|
|
* `permissions` array from that choice field by field, so no request shape can
|
|
* coerce this endpoint into minting a wildcard or any other grant.
|
|
*/
|
|
export const createMcpTokenSchema = z.object({
|
|
name: z.string().min(1, "Name required").max(100),
|
|
expiresInDays: z.number().int().min(1).max(365).optional(),
|
|
scope: z.enum(["read", "read_write"]).optional().default("read"),
|
|
});
|
|
|
|
export type CreateMcpTokenInput = z.infer<typeof createMcpTokenSchema>;
|