mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-12 22:26:13 +00:00
Marc-André Bombeck
883fd2d047
Three additions to the contract, all of them things a native client cannot work out on its own. `GET /api/auth/me` enters the spec for the first time, and enters it loose: `accountAccess` is specified in full, the remaining preference fields are declared open rather than half-enumerated. The endpoint has never been in this document and its payload carries thirty-odd keys no contract has ever named; specifying a subset and closing the object would publish something the server does not keep. `X-HealthLog-Account` is published as a reusable parameter with no route referencing it, which is the honest state of the contract — the routes that read another account's record arrive with the surface migration and will reference it as they land. The header is live in the resolver today, and a client needs the description before it can be built against a tagged spec: the value comes from `accountAccess.accounts`, it is a selector and never a permission, and it must never ride the sync engine, device registration, or an auth call. `GET /api/account/activity` carries `retentionDays` in the response and says why: the window is operator-configurable, so a client that assumed 365 would tell somebody their record was never opened when the honest answer is "further back than this reaches". The parameter is defined in the sharing route module rather than the shared components block, so the boundary guard keeps holding the header's name to two files — the resolver that reads it, and the one place that publishes it.
92 lines
1.9 KiB
Plaintext
92 lines
1.9 KiB
Plaintext
# dependencies
|
|
/node_modules
|
|
/.pnp
|
|
.pnp.*
|
|
.yarn/*
|
|
!.yarn/patches
|
|
!.yarn/plugins
|
|
!.yarn/releases
|
|
!.yarn/versions
|
|
|
|
# testing
|
|
/coverage
|
|
|
|
# HAR captures from production debugging (may contain auth headers/cookies)
|
|
*.har
|
|
|
|
# playwright e2e
|
|
/test-results
|
|
/playwright-report
|
|
/playwright/.cache
|
|
/e2e/setup/storageState.json
|
|
/e2e/setup/storageStateOwner.json
|
|
|
|
# next.js
|
|
/.next/
|
|
/out/
|
|
|
|
# production
|
|
/build
|
|
|
|
# misc
|
|
.DS_Store
|
|
*.pem
|
|
|
|
# debug
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
.pnpm-debug.log*
|
|
|
|
# env files
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
|
|
# typescript
|
|
*.tsbuildinfo
|
|
next-env.d.ts
|
|
|
|
# prisma generated — ignore the whole path so a stray symlink at
|
|
# `src/generated` (e.g. from a worktree) can never be committed
|
|
/src/generated
|
|
|
|
# v1.4.43 QoL (L3) — generated at build time by
|
|
# scripts/generate-sw-version.mjs; loaded by public/sw.js to key
|
|
# the cache-version baseline.
|
|
/public/sw-version.js
|
|
/public/i18n/
|
|
|
|
# v1.4.27 B3 — MaxMind GeoLite2 databases are fetched at build time
|
|
# via `scripts/fetch-geolite2.sh`. Too large for git; license key
|
|
# required. The folder + a `.gitkeep` are tracked so the Dockerfile
|
|
# COPY target always exists.
|
|
/assets/geolite2/*.mmdb
|
|
|
|
# Local workspace files, never committed
|
|
/docs/superpowers/
|
|
.claude/
|
|
.cursor/
|
|
.codex/
|
|
.aider*
|
|
|
|
# Planning scratch — all internal per-release reports, QA findings, ad-hoc
|
|
# backlog, and the iOS coordination channel. These are internal working
|
|
# notes; everything user-facing lives in the public surfaces (README,
|
|
# CHANGELOG, docs/). Kept on disk for the working session, never tracked.
|
|
/.planning/
|
|
|
|
# Docs scratch — temporary spec drafts that live in the repo only
|
|
# while a release is in flight.
|
|
/docs/ios/
|
|
|
|
# Per-release internal forensic notes — retained locally for
|
|
# traceability across releases but not part of the public docs surface.
|
|
/docs/audit/
|
|
|
|
# Local screenshot/audit harnesses (repo-root for module resolution; never committed)
|
|
.audit-*.mjs
|
|
|
|
|
|
# Isolated development worktrees
|
|
/.worktrees/ |