release/v1.37.6 - #765
Merged
Merged
Conversation
A Vorsorge screening (PHQ-9, GAD-7, WHO-5, SCI) resolves only from the score row a completed check-in writes, never from a manual done. The web and iOS clients enforce this by routing a screening to the check-in page instead of offering the done action, but the satisfy and complete routes trusted that gate and would stamp any reminder, screening included. A crafted POST could therefore mark a screening satisfied with no assessment behind it. Both routes now reject a screening reminder with 409 before the shared satisfy primitive runs, mirroring the client rule as defense in depth. Typed numeric reminders keep their manual satisfy, which is intentional and covered. The satisfy route gains its first route test alongside the new guard case on complete.
Editing a custom mood tag or group, and editing a custom cycle symptom, wrote nothing to the audit ledger, while their delete siblings did. Two of these paths destroy data: a custom mood tag or cycle symptom purged with ?purge=true cascades its entry links and unpicks historical entries, so a destruction left no trace of who ran it or when. Every vocabulary-mutating verb now records an audit row: create, edit, and delete for both custom tags and custom groups, and edit for a custom cycle symptom. Encrypted labels are never logged; the row carries only the field names touched and the resulting active state. The two display-only writes on this surface, hiding a catalogue tag and reordering the layout, stay ledger-free by design and say so inline, since a per-user display preference is not a health-data write and a row on every drag-to-reorder would be noise rather than a record.
Two hardening changes collected on the trunk: a screening reminder can no longer be marked done through a crafted request, and editing a custom mood tag, tag group or cycle symptom now leaves an audit entry the way deleting one already did.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Server-side safety pass, two hardening changes collected on the trunk.
No schema change, no migration. Semver patch.