Marc-André Bombeck c6be0778dc Let a delegate enter a lab result and the marker it needs ...

POST /api/labs and POST /api/biomarkers resolve the record. The free-text
lab path mints its biomarker under the record's catalogue rather than the
caller's — a result added to somebody's record whose marker landed on the
helper's account would leave the owner with a reading they cannot chart.

Adding a marker the record already tracks stays the ordinary 409 from the
same per-account uniqueness the owner would hit themselves. The PUT and
DELETE on the sibling routes are unchanged and still refuse under a switch.

Both validation breadcrumbs move to auditLog(), the only writer that stamps
the acting account.

2026-08-03 12:10:49 +02:00

..

error-contract.test.ts

Let a delegate enter a lab result and the marker it needs

2026-08-03 12:10:49 +02:00