Add private health tracker (owner-only)
- health schema: vaccinations, body_measurements, workouts, nutrition_daily, sleep (generated hours), medications, hair_progress, appointments - migration with updated_at triggers; grants to personal_app only - /trackers/health overview with add/edit/delete, owner-gated (404 otherwise), noindex + private no-store, hidden from listings for non-owners - owner-only JSON/CSV import endpoint and scripts/health-import.ts
This commit is contained in:
199
src/lib/server/db/schema/health.ts
Normal file
199
src/lib/server/db/schema/health.ts
Normal file
@@ -0,0 +1,199 @@
|
||||
import { check, date, index, integer, numeric, text, timestamp, uuid } from 'drizzle-orm/pg-core';
|
||||
import { sql } from 'drizzle-orm';
|
||||
import { healthSchema } from './schemas';
|
||||
import { timestamps, timestamptz } from './helpers';
|
||||
|
||||
// Private health log (owner only, see requireOwner). No user_id: there is exactly one
|
||||
// owner, and the whole schema is readable by personal_app only (no personal_ro grant).
|
||||
// Numerics use mode 'number' so the app gets plain numbers instead of strings.
|
||||
|
||||
const pk = () => uuid('id').primaryKey().defaultRandom();
|
||||
const day = (name = 'date') => date(name, { mode: 'string' });
|
||||
const sane = (column: string) => sql.raw(`"${column}" >= DATE '1900-01-01'`);
|
||||
|
||||
export const healthVaccinations = healthSchema.table(
|
||||
'vaccinations',
|
||||
{
|
||||
id: pk(),
|
||||
vaccine: text('vaccine').notNull(),
|
||||
target: text('target'), // disease(s) it protects against, e.g. "DTP", "COVID-19"
|
||||
doseNo: integer('dose_no'),
|
||||
date: day().notNull(),
|
||||
batchLot: text('batch_lot'),
|
||||
provider: text('provider'), // GGD, GP, travel clinic...
|
||||
country: text('country'), // ISO 3166-1 alpha-2, e.g. NL
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
index('vaccinations_date_idx').on(t.date),
|
||||
check('vaccinations_vaccine_check', sql`length(btrim(${t.vaccine})) > 0`),
|
||||
check('vaccinations_dose_no_check', sql`${t.doseNo} IS NULL OR ${t.doseNo} BETWEEN 1 AND 20`),
|
||||
check('vaccinations_country_check', sql`${t.country} IS NULL OR ${t.country} ~ '^[A-Z]{2}$'`),
|
||||
check('vaccinations_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
|
||||
export const healthBodyMeasurements = healthSchema.table(
|
||||
'body_measurements',
|
||||
{
|
||||
id: pk(),
|
||||
date: day().notNull(),
|
||||
weightKg: numeric('weight_kg', { precision: 5, scale: 2, mode: 'number' }),
|
||||
waistCm: numeric('waist_cm', { precision: 5, scale: 1, mode: 'number' }), // at the navel
|
||||
bodyFatPct: numeric('body_fat_pct', { precision: 4, scale: 1, mode: 'number' }),
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
index('body_measurements_date_idx').on(t.date),
|
||||
check(
|
||||
'body_measurements_any_check',
|
||||
sql`${t.weightKg} IS NOT NULL OR ${t.waistCm} IS NOT NULL OR ${t.bodyFatPct} IS NOT NULL`
|
||||
),
|
||||
check(
|
||||
'body_measurements_weight_check',
|
||||
sql`${t.weightKg} IS NULL OR ${t.weightKg} BETWEEN 20 AND 400`
|
||||
),
|
||||
check(
|
||||
'body_measurements_waist_check',
|
||||
sql`${t.waistCm} IS NULL OR ${t.waistCm} BETWEEN 30 AND 250`
|
||||
),
|
||||
check(
|
||||
'body_measurements_fat_check',
|
||||
sql`${t.bodyFatPct} IS NULL OR ${t.bodyFatPct} BETWEEN 1 AND 75`
|
||||
),
|
||||
check('body_measurements_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
|
||||
export const healthWorkouts = healthSchema.table(
|
||||
'workouts',
|
||||
{
|
||||
id: pk(),
|
||||
date: day().notNull(),
|
||||
sessionId: uuid('session_id'), // optional: groups the exercises of one session
|
||||
exercise: text('exercise').notNull(),
|
||||
sets: integer('sets'),
|
||||
reps: integer('reps'), // per set
|
||||
loadKg: numeric('load_kg', { precision: 6, scale: 2, mode: 'number' }),
|
||||
rpe: numeric('rpe', { precision: 3, scale: 1, mode: 'number' }),
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
index('workouts_date_idx').on(t.date),
|
||||
index('workouts_session_idx').on(t.sessionId),
|
||||
check('workouts_exercise_check', sql`length(btrim(${t.exercise})) > 0`),
|
||||
check('workouts_sets_check', sql`${t.sets} IS NULL OR ${t.sets} BETWEEN 1 AND 100`),
|
||||
check('workouts_reps_check', sql`${t.reps} IS NULL OR ${t.reps} BETWEEN 0 AND 1000`),
|
||||
check('workouts_load_check', sql`${t.loadKg} IS NULL OR ${t.loadKg} BETWEEN 0 AND 1000`),
|
||||
check('workouts_rpe_check', sql`${t.rpe} IS NULL OR ${t.rpe} BETWEEN 1 AND 10`),
|
||||
check('workouts_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
|
||||
export const healthNutritionDaily = healthSchema.table(
|
||||
'nutrition_daily',
|
||||
{
|
||||
id: pk(),
|
||||
date: day().notNull().unique('nutrition_daily_date_key'),
|
||||
kcal: integer('kcal'),
|
||||
proteinG: numeric('protein_g', { precision: 5, scale: 1, mode: 'number' }),
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
check('nutrition_daily_kcal_check', sql`${t.kcal} IS NULL OR ${t.kcal} BETWEEN 0 AND 20000`),
|
||||
check(
|
||||
'nutrition_daily_protein_check',
|
||||
sql`${t.proteinG} IS NULL OR ${t.proteinG} BETWEEN 0 AND 1000`
|
||||
),
|
||||
check('nutrition_daily_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
|
||||
export const healthSleep = healthSchema.table(
|
||||
'sleep',
|
||||
{
|
||||
id: pk(),
|
||||
date: day().notNull().unique('sleep_date_key'), // the wake-up date of the night
|
||||
bedtime: timestamptz('bedtime').notNull(),
|
||||
wakeTime: timestamp('wake_time', { withTimezone: true }).notNull(),
|
||||
hours: numeric('hours', { precision: 4, scale: 2, mode: 'number' }).generatedAlwaysAs(
|
||||
sql`round((extract(epoch from (wake_time - bedtime)) / 3600)::numeric, 2)`
|
||||
),
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
check('sleep_order_check', sql`${t.wakeTime} > ${t.bedtime}`),
|
||||
check('sleep_length_check', sql`${t.wakeTime} - ${t.bedtime} <= interval '24 hours'`),
|
||||
check('sleep_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
|
||||
export const healthMedications = healthSchema.table(
|
||||
'medications',
|
||||
{
|
||||
id: pk(),
|
||||
name: text('name').notNull(),
|
||||
kind: text('kind').notNull().default('medication'),
|
||||
dose: text('dose'), // free text: "1 mg", "5% solution, 1 ml"
|
||||
frequency: text('frequency'), // free text: "daily", "2x daily", "as needed"
|
||||
startDate: day('start_date'),
|
||||
stopDate: day('stop_date'), // null = still taking it
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
index('medications_start_date_idx').on(t.startDate),
|
||||
index('medications_stop_date_idx').on(t.stopDate),
|
||||
check('medications_name_check', sql`length(btrim(${t.name})) > 0`),
|
||||
check('medications_kind_check', sql`${t.kind} IN ('medication','supplement')`),
|
||||
check(
|
||||
'medications_dates_check',
|
||||
sql`${t.stopDate} IS NULL OR ${t.startDate} IS NULL OR ${t.stopDate} >= ${t.startDate}`
|
||||
)
|
||||
]
|
||||
);
|
||||
|
||||
export const healthHairProgress = healthSchema.table(
|
||||
'hair_progress',
|
||||
{
|
||||
id: pk(),
|
||||
date: day().notNull(),
|
||||
// Key/path into private storage (never a public URL), e.g. "health/hair/2026-10-24-top.jpg".
|
||||
photoRef: text('photo_ref'),
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
index('hair_progress_date_idx').on(t.date),
|
||||
check(
|
||||
'hair_progress_photo_ref_check',
|
||||
sql`${t.photoRef} IS NULL OR (${t.photoRef} !~* '^[a-z][a-z0-9+.-]*://' AND ${t.photoRef} !~ '^//')`
|
||||
),
|
||||
check('hair_progress_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
|
||||
export const healthAppointments = healthSchema.table(
|
||||
'appointments',
|
||||
{
|
||||
id: pk(),
|
||||
date: day().notNull(),
|
||||
type: text('type').notNull().default('appointment'),
|
||||
provider: text('provider'),
|
||||
notes: text('notes'),
|
||||
...timestamps
|
||||
},
|
||||
(t) => [
|
||||
index('appointments_date_idx').on(t.date),
|
||||
check(
|
||||
'appointments_type_check',
|
||||
sql`${t.type} IN ('appointment','checkup','condition','test','procedure','other')`
|
||||
),
|
||||
check('appointments_date_check', sane('date'))
|
||||
]
|
||||
);
|
||||
@@ -12,3 +12,4 @@ export * from './schemas';
|
||||
export * from './money-tracker';
|
||||
export * from './cs-prices';
|
||||
export * from './house-tracker';
|
||||
export * from './health';
|
||||
|
||||
@@ -12,3 +12,4 @@ export const csSchema = pgSchema('cs');
|
||||
export const animaldexSchema = pgSchema('animaldex');
|
||||
export const siteSchema = pgSchema('site');
|
||||
export const metaSchema = pgSchema('meta');
|
||||
export const healthSchema = pgSchema('health');
|
||||
|
||||
55
src/lib/server/health-import.test.ts
Normal file
55
src/lib/server/health-import.test.ts
Normal file
@@ -0,0 +1,55 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import { amsterdamTime, cleanRow, parseCsv, toPayload, validatePayload } from './health-import';
|
||||
|
||||
describe('health import', () => {
|
||||
it('parses CSV with quotes and semicolons', () => {
|
||||
expect(parseCsv('date;kcal;notes\r\n2026-01-02;2500;"a; ""b"""\n')).toEqual([
|
||||
{ date: '2026-01-02', kcal: '2500', notes: 'a; "b"' }
|
||||
]);
|
||||
});
|
||||
it('validates and camel-cases rows', () => {
|
||||
const r = cleanRow('body_measurements', {
|
||||
date: '2026-01-02',
|
||||
weight_kg: '80,5',
|
||||
waist_cm: ''
|
||||
});
|
||||
expect(r).toEqual({
|
||||
ok: true,
|
||||
row: {
|
||||
id: undefined,
|
||||
values: { date: '2026-01-02', weightKg: 80.5, waistCm: null, bodyFatPct: null, notes: null }
|
||||
}
|
||||
});
|
||||
expect(cleanRow('body_measurements', { date: '2026-01-02' }).ok).toBe(false);
|
||||
expect(cleanRow('workouts', { date: '2026-01-02', exercise: 'squat', rpe: 11 }).ok).toBe(false);
|
||||
expect(cleanRow('workouts', { date: '2026-01-02', exercise: 'squat', bogus: 1 }).ok).toBe(
|
||||
false
|
||||
);
|
||||
expect(cleanRow('hair_progress', { date: '2026-01-02', photo_ref: 'https://x/y.jpg' }).ok).toBe(
|
||||
false
|
||||
);
|
||||
expect(
|
||||
cleanRow('vaccinations', { vaccine: 'X', date: '2026-01-02', country: 'nl' })
|
||||
).toMatchObject({ ok: true, row: { values: { country: 'NL' } } });
|
||||
});
|
||||
it('resolves bare sleep times in Amsterdam time', () => {
|
||||
const r = cleanRow('sleep', { date: '2026-07-02', bedtime: '23:30', wake_time: '07:15' });
|
||||
expect(r.ok && (r.row.values.bedtime as Date).toISOString()).toBe('2026-07-01T21:30:00.000Z');
|
||||
expect(r.ok && (r.row.values.wakeTime as Date).toISOString()).toBe('2026-07-02T05:15:00.000Z');
|
||||
expect(amsterdamTime('2026-01-15', '12:00')?.toISOString()).toBe('2026-01-15T11:00:00.000Z');
|
||||
const after = cleanRow('sleep', { date: '2026-07-02', bedtime: '00:40', wake_time: '08:00' });
|
||||
expect(after.ok && (after.row.values.bedtime as Date).toISOString()).toBe(
|
||||
'2026-07-01T22:40:00.000Z'
|
||||
);
|
||||
});
|
||||
it('reports errors per row and table', () => {
|
||||
const { errors } = validatePayload(
|
||||
toPayload({ nutrition_daily: [{ date: 'x' }, { date: '2026-01-01', kcal: 2000 }] })
|
||||
);
|
||||
expect(errors).toEqual([
|
||||
{ table: 'nutrition_daily', row: 1, error: expect.stringContaining('date') }
|
||||
]);
|
||||
expect(() => toPayload([{}])).toThrow();
|
||||
expect(() => toPayload({ nope: [] })).toThrow();
|
||||
});
|
||||
});
|
||||
357
src/lib/server/health-import.ts
Normal file
357
src/lib/server/health-import.ts
Normal file
@@ -0,0 +1,357 @@
|
||||
// Validation + import for the private health tables. Shared by the owner-only import
|
||||
// endpoint (/trackers/health/import), the page's add/edit forms and
|
||||
// scripts/health-import.ts, so it must not import anything from SvelteKit.
|
||||
import { sql } from 'drizzle-orm';
|
||||
import type { PgAsyncDatabase } from 'drizzle-orm/pg-core';
|
||||
import {
|
||||
healthAppointments,
|
||||
healthBodyMeasurements,
|
||||
healthHairProgress,
|
||||
healthMedications,
|
||||
healthNutritionDaily,
|
||||
healthSleep,
|
||||
healthVaccinations,
|
||||
healthWorkouts
|
||||
} from './db/schema/health';
|
||||
import { healthTables, isHealthTable, type Field, type HealthTable } from '../health/tables';
|
||||
|
||||
export const drizzleTables = {
|
||||
vaccinations: healthVaccinations,
|
||||
body_measurements: healthBodyMeasurements,
|
||||
workouts: healthWorkouts,
|
||||
nutrition_daily: healthNutritionDaily,
|
||||
sleep: healthSleep,
|
||||
medications: healthMedications,
|
||||
hair_progress: healthHairProgress,
|
||||
appointments: healthAppointments
|
||||
} as const;
|
||||
|
||||
/** Tables with one row per day: importing the same date again updates that day. */
|
||||
const uniqueByDate = new Set<HealthTable>(['nutrition_daily', 'sleep']);
|
||||
/** Columns that exports may contain but imports ignore. */
|
||||
const ignored = new Set(['hours', 'created_at', 'updated_at']);
|
||||
const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
|
||||
export const TIME_ZONE = 'Europe/Amsterdam';
|
||||
export const MAX_ROWS = 5000;
|
||||
|
||||
type Row = Record<string, unknown>;
|
||||
export type CleanRow = { id?: string; values: Record<string, unknown> };
|
||||
export type RowResult = { ok: true; row: CleanRow } | { ok: false; error: string };
|
||||
|
||||
const camel = (key: string) => key.replace(/_([a-z])/g, (_, c: string) => c.toUpperCase());
|
||||
|
||||
export function validDate(raw: string): string | null {
|
||||
if (!/^\d{4}-\d{2}-\d{2}$/.test(raw)) return null;
|
||||
const d = new Date(`${raw}T12:00:00Z`);
|
||||
return !Number.isNaN(d.valueOf()) && d.toISOString().slice(0, 10) === raw && raw >= '1900-01-01'
|
||||
? raw
|
||||
: null;
|
||||
}
|
||||
|
||||
/** Offset of Europe/Amsterdam (ms) at a given UTC instant. */
|
||||
function zoneOffset(utc: number): number {
|
||||
const parts = new Intl.DateTimeFormat('en-US', {
|
||||
timeZone: TIME_ZONE,
|
||||
hourCycle: 'h23',
|
||||
year: 'numeric',
|
||||
month: '2-digit',
|
||||
day: '2-digit',
|
||||
hour: '2-digit',
|
||||
minute: '2-digit',
|
||||
second: '2-digit'
|
||||
}).formatToParts(new Date(utc));
|
||||
const get = (type: string) => Number(parts.find((p) => p.type === type)?.value);
|
||||
return (
|
||||
Date.UTC(get('year'), get('month') - 1, get('day'), get('hour'), get('minute'), get('second')) -
|
||||
utc
|
||||
);
|
||||
}
|
||||
|
||||
/** Wall-clock time in Amsterdam ("YYYY-MM-DD", "HH:MM[:SS]") to a Date. */
|
||||
export function amsterdamTime(day: string, time: string): Date | null {
|
||||
const m = /^(\d{1,2}):(\d{2})(?::(\d{2}))?$/.exec(time);
|
||||
if (!m || !validDate(day)) return null;
|
||||
const [h, min, s] = [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)];
|
||||
if (h > 23 || min > 59 || s > 59) return null;
|
||||
const [y, mo, d] = day.split('-').map(Number);
|
||||
const wall = Date.UTC(y, mo - 1, d, h, min, s);
|
||||
let utc = wall - zoneOffset(wall);
|
||||
utc = wall - zoneOffset(utc); // second pass settles DST edges
|
||||
return new Date(utc);
|
||||
}
|
||||
|
||||
/**
|
||||
* Datetimes: ISO with offset ("2026-10-24T07:10:00+02:00", "...Z"), local Amsterdam
|
||||
* ("2026-10-24T07:10" / "2026-10-24 07:10", which is what <input type=datetime-local> sends),
|
||||
* or a bare "HH:MM" resolved against the row's date by the caller.
|
||||
*/
|
||||
function parseDateTime(raw: string): Date | 'time' | null {
|
||||
if (/^\d{1,2}:\d{2}(:\d{2})?$/.test(raw)) return 'time';
|
||||
const local = /^(\d{4}-\d{2}-\d{2})[T ](\d{2}:\d{2}(?::\d{2})?)(?:\.\d+)?$/.exec(raw);
|
||||
if (local) return amsterdamTime(local[1], local[2]);
|
||||
if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})$/i.test(raw)) {
|
||||
const d = new Date(raw);
|
||||
return Number.isNaN(d.valueOf()) ? null : d;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function cleanField(field: Field, value: unknown): { value: unknown } | { error: string } {
|
||||
if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
|
||||
return field.required ? { error: `${field.key} is required` } : { value: null };
|
||||
}
|
||||
const raw = typeof value === 'string' ? value.trim() : value;
|
||||
switch (field.type) {
|
||||
case 'text':
|
||||
case 'textarea': {
|
||||
if (typeof raw !== 'string' && typeof raw !== 'number')
|
||||
return { error: `${field.key} must be text` };
|
||||
const text = String(raw);
|
||||
if (field.maxLength && text.length > field.maxLength)
|
||||
return { error: `${field.key} is longer than ${field.maxLength} characters` };
|
||||
return { value: text };
|
||||
}
|
||||
case 'integer':
|
||||
case 'number': {
|
||||
const n = typeof raw === 'number' ? raw : Number(String(raw).replace(',', '.'));
|
||||
if (!Number.isFinite(n)) return { error: `${field.key} must be a number` };
|
||||
if (field.type === 'integer' && !Number.isInteger(n))
|
||||
return { error: `${field.key} must be a whole number` };
|
||||
if ((field.min !== undefined && n < field.min) || (field.max !== undefined && n > field.max))
|
||||
return { error: `${field.key} must be between ${field.min} and ${field.max}` };
|
||||
return { value: n };
|
||||
}
|
||||
case 'date': {
|
||||
const d = typeof raw === 'string' ? validDate(raw) : null;
|
||||
return d
|
||||
? { value: d }
|
||||
: { error: `${field.key} must be a date (YYYY-MM-DD, 1900 or later)` };
|
||||
}
|
||||
case 'datetime': {
|
||||
const d = typeof raw === 'string' ? parseDateTime(raw) : null;
|
||||
return d ? { value: d } : { error: `${field.key} must be an ISO datetime or HH:MM` };
|
||||
}
|
||||
case 'select':
|
||||
return field.options?.includes(String(raw))
|
||||
? { value: String(raw) }
|
||||
: { error: `${field.key} must be one of ${field.options?.join(', ')}` };
|
||||
case 'uuid':
|
||||
return typeof raw === 'string' && UUID.test(raw)
|
||||
? { value: raw.toLowerCase() }
|
||||
: { error: `${field.key} must be a UUID` };
|
||||
}
|
||||
}
|
||||
|
||||
/** Validate one row (snake_case keys) for a table. Unknown keys are rejected. */
|
||||
export function cleanRow(table: HealthTable, input: Row): RowResult {
|
||||
if (!input || typeof input !== 'object' || Array.isArray(input))
|
||||
return { ok: false, error: 'row must be an object' };
|
||||
const fields: readonly Field[] = healthTables[table].fields;
|
||||
const known = new Set(fields.map((f) => f.key));
|
||||
for (const key of Object.keys(input))
|
||||
if (key !== 'id' && !known.has(key) && !ignored.has(key))
|
||||
return { ok: false, error: `unknown column "${key}"` };
|
||||
let id: string | undefined;
|
||||
if (input.id !== undefined && input.id !== null && input.id !== '') {
|
||||
if (typeof input.id !== 'string' || !UUID.test(input.id))
|
||||
return { ok: false, error: 'id must be a UUID' };
|
||||
id = input.id.toLowerCase();
|
||||
}
|
||||
const v: Record<string, unknown> = {};
|
||||
for (const field of fields) {
|
||||
const result = cleanField(field, input[field.key]);
|
||||
if ('error' in result) return { ok: false, error: result.error };
|
||||
v[field.key] = result.value;
|
||||
}
|
||||
|
||||
// Table-specific rules (mirrors the CHECK constraints, with friendlier messages).
|
||||
if (table === 'vaccinations' && typeof v.country === 'string') {
|
||||
const country = v.country.toUpperCase();
|
||||
v.country = country;
|
||||
if (!/^[A-Z]{2}$/.test(country))
|
||||
return { ok: false, error: 'country must be a 2-letter ISO code, e.g. NL' };
|
||||
}
|
||||
if (
|
||||
table === 'body_measurements' &&
|
||||
v.weight_kg === null &&
|
||||
v.waist_cm === null &&
|
||||
v.body_fat_pct === null
|
||||
)
|
||||
return { ok: false, error: 'give at least one of weight_kg, waist_cm, body_fat_pct' };
|
||||
if (table === 'medications') {
|
||||
v.kind ??= 'medication';
|
||||
if (v.start_date && v.stop_date && String(v.stop_date) < String(v.start_date))
|
||||
return { ok: false, error: 'stop_date is before start_date' };
|
||||
}
|
||||
if (table === 'appointments') v.type ??= 'appointment';
|
||||
if (
|
||||
table === 'hair_progress' &&
|
||||
typeof v.photo_ref === 'string' &&
|
||||
/^([a-z][a-z0-9+.-]*:|\/\/)/i.test(v.photo_ref)
|
||||
)
|
||||
return { ok: false, error: 'photo_ref must be a private storage key/path, not a URL' };
|
||||
if (table === 'sleep') {
|
||||
const day = String(v.date);
|
||||
const wakeRaw = String(input.wake_time).trim();
|
||||
const bedRaw = String(input.bedtime).trim();
|
||||
if (v.wake_time === 'time') v.wake_time = amsterdamTime(day, wakeRaw);
|
||||
if (v.bedtime === 'time') {
|
||||
// A bare bedtime is on the wake-up day if it is before the wake time, else the evening before.
|
||||
const sameDay = amsterdamTime(day, bedRaw);
|
||||
const wake = v.wake_time as Date | null;
|
||||
if (sameDay && wake && sameDay < wake) v.bedtime = sameDay;
|
||||
else {
|
||||
const prev = new Date(`${day}T12:00:00Z`);
|
||||
prev.setUTCDate(prev.getUTCDate() - 1);
|
||||
v.bedtime = amsterdamTime(prev.toISOString().slice(0, 10), bedRaw);
|
||||
}
|
||||
}
|
||||
const bed = v.bedtime as Date | null;
|
||||
const wake = v.wake_time as Date | null;
|
||||
if (!bed || !wake) return { ok: false, error: 'invalid bedtime / wake_time' };
|
||||
if (wake <= bed) return { ok: false, error: 'wake_time must be after bedtime' };
|
||||
if (wake.getTime() - bed.getTime() > 24 * 3600e3)
|
||||
return { ok: false, error: 'sleep longer than 24 hours' };
|
||||
} else {
|
||||
for (const key of Object.keys(v))
|
||||
if (v[key] === 'time') return { ok: false, error: `${key} needs a full datetime` };
|
||||
}
|
||||
|
||||
const values: Record<string, unknown> = {};
|
||||
for (const [key, value] of Object.entries(v)) values[camel(key)] = value;
|
||||
return { ok: true, row: { id, values } };
|
||||
}
|
||||
|
||||
/** Minimal RFC 4180 CSV parser: header row, quoted fields, CRLF, BOM. Semicolons allowed as delimiter. */
|
||||
export function parseCsv(text: string): Row[] {
|
||||
const src = text.replace(/^\uFEFF/, '');
|
||||
const firstLine = src.split(/\r?\n/, 1)[0] ?? '';
|
||||
const delimiter =
|
||||
(firstLine.match(/;/g)?.length ?? 0) > (firstLine.match(/,/g)?.length ?? 0) ? ';' : ',';
|
||||
const records: string[][] = [];
|
||||
let record: string[] = [];
|
||||
let field = '';
|
||||
let quoted = false;
|
||||
const endField = () => {
|
||||
record.push(field);
|
||||
field = '';
|
||||
};
|
||||
const endRecord = () => {
|
||||
endField();
|
||||
records.push(record);
|
||||
record = [];
|
||||
};
|
||||
for (let i = 0; i < src.length; i++) {
|
||||
const c = src[i];
|
||||
if (quoted) {
|
||||
if (c === '"' && src[i + 1] === '"') {
|
||||
field += '"';
|
||||
i++;
|
||||
} else if (c === '"') quoted = false;
|
||||
else field += c;
|
||||
} else if (c === '"' && field === '') quoted = true;
|
||||
else if (c === delimiter) endField();
|
||||
else if (c === '\n' || c === '\r') {
|
||||
if (c === '\r' && src[i + 1] === '\n') i++;
|
||||
endRecord();
|
||||
} else field += c;
|
||||
}
|
||||
if (quoted) throw new Error('CSV has an unterminated quoted field');
|
||||
if (field !== '' || record.length) endRecord();
|
||||
const rows = records.filter((r) => r.some((cell) => cell.trim() !== ''));
|
||||
if (!rows.length) return [];
|
||||
const header = rows[0].map((h) => h.trim().toLowerCase());
|
||||
if (new Set(header).size !== header.length) throw new Error('CSV header has duplicate columns');
|
||||
return rows.slice(1).map((cells, line) => {
|
||||
if (cells.length > header.length)
|
||||
throw new Error(`CSV row ${line + 2} has more cells than the header`);
|
||||
return Object.fromEntries(header.map((h, i) => [h, cells[i] ?? '']));
|
||||
});
|
||||
}
|
||||
|
||||
export type Payload = Partial<Record<HealthTable, Row[]>>;
|
||||
|
||||
/**
|
||||
* Accepted shapes:
|
||||
* JSON object keyed by table: { "vaccinations": [ {...}, ... ], "sleep": [ ... ] }
|
||||
* JSON array of rows + table: [ {...}, ... ] (table given separately)
|
||||
* CSV with a header row + table
|
||||
*/
|
||||
export function toPayload(body: unknown, table?: string | null): Payload {
|
||||
if (Array.isArray(body)) {
|
||||
if (!isHealthTable(table))
|
||||
throw new Error('a plain list of rows needs a table (?table= or --table)');
|
||||
return { [table]: body };
|
||||
}
|
||||
if (!body || typeof body !== 'object')
|
||||
throw new Error('expected a JSON object keyed by table, or an array of rows');
|
||||
const payload: Payload = {};
|
||||
for (const [key, rows] of Object.entries(body)) {
|
||||
if (!isHealthTable(key)) throw new Error(`unknown table "${key}"`);
|
||||
if (!Array.isArray(rows)) throw new Error(`"${key}" must be an array of rows`);
|
||||
payload[key] = rows as Row[];
|
||||
}
|
||||
return payload;
|
||||
}
|
||||
|
||||
export type ValidationError = { table: HealthTable; row: number; error: string };
|
||||
|
||||
export function validatePayload(payload: Payload) {
|
||||
const clean: Partial<Record<HealthTable, CleanRow[]>> = {};
|
||||
const errors: ValidationError[] = [];
|
||||
let total = 0;
|
||||
for (const [table, rows] of Object.entries(payload) as [HealthTable, Row[]][]) {
|
||||
total += rows.length;
|
||||
clean[table] = [];
|
||||
rows.forEach((row, i) => {
|
||||
const result = cleanRow(table, row);
|
||||
if (result.ok) clean[table]!.push(result.row);
|
||||
else errors.push({ table, row: i + 1, error: result.error });
|
||||
});
|
||||
}
|
||||
if (total > MAX_ROWS)
|
||||
errors.push({
|
||||
table: Object.keys(payload)[0] as HealthTable,
|
||||
row: 0,
|
||||
error: `more than ${MAX_ROWS} rows`
|
||||
});
|
||||
return { clean, errors };
|
||||
}
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
type Db = PgAsyncDatabase<any, any>;
|
||||
export type ImportCounts = Partial<Record<HealthTable, { inserted: number; updated: number }>>;
|
||||
|
||||
/** Insert/update rows; all-or-nothing in one transaction. Rows with an id update that row;
|
||||
* nutrition_daily and sleep upsert on date. */
|
||||
export async function writeRows(
|
||||
db: Db,
|
||||
clean: Partial<Record<HealthTable, CleanRow[]>>
|
||||
): Promise<ImportCounts> {
|
||||
return db.transaction(async (tx) => {
|
||||
const counts: ImportCounts = {};
|
||||
for (const [table, rows] of Object.entries(clean) as [HealthTable, CleanRow[]][]) {
|
||||
const target = drizzleTables[table];
|
||||
const count = { inserted: 0, updated: 0 };
|
||||
for (const { id, values } of rows) {
|
||||
const data = { ...values, ...(id ? { id } : {}) };
|
||||
const set = { ...values, updatedAt: new Date() };
|
||||
const conflictTarget = id
|
||||
? target.id
|
||||
: uniqueByDate.has(table)
|
||||
? (target as typeof healthSleep).date
|
||||
: null;
|
||||
const query = tx.insert(target).values(data as never);
|
||||
const [result] = await (
|
||||
conflictTarget
|
||||
? query.onConflictDoUpdate({ target: conflictTarget, set: set as never })
|
||||
: query
|
||||
).returning({ inserted: sql<boolean>`(xmax = 0)` });
|
||||
if (result?.inserted) count.inserted++;
|
||||
else count.updated++;
|
||||
}
|
||||
counts[table] = count;
|
||||
}
|
||||
return counts;
|
||||
});
|
||||
}
|
||||
21
src/lib/server/owner.test.ts
Normal file
21
src/lib/server/owner.test.ts
Normal file
@@ -0,0 +1,21 @@
|
||||
import { describe, expect, it } from 'vitest';
|
||||
import { isOwner, isOwnerOnlyPath } from './owner';
|
||||
|
||||
const event = (user: Partial<NonNullable<App.Locals['user']>> | null) =>
|
||||
({ locals: { user, session: null } }) as unknown as { locals: App.Locals };
|
||||
|
||||
describe('owner gate', () => {
|
||||
it('needs admin role and the owner email', () => {
|
||||
expect(isOwner(event(null))).toBe(false);
|
||||
expect(isOwner(event({ role: 'admin', email: 'someone@example.com' }))).toBe(false);
|
||||
expect(isOwner(event({ role: 'user', email: 'stan@stanrunge.dev' }))).toBe(false);
|
||||
expect(isOwner(event({ role: 'admin', email: 'Stan@StanRunge.dev' }))).toBe(true);
|
||||
});
|
||||
it('matches owner-only paths', () => {
|
||||
expect(isOwnerOnlyPath('/trackers/health')).toBe(true);
|
||||
expect(isOwnerOnlyPath('/trackers/health/')).toBe(true);
|
||||
expect(isOwnerOnlyPath('/trackers/Health/import')).toBe(true);
|
||||
expect(isOwnerOnlyPath('/trackers/healthy')).toBe(false);
|
||||
expect(isOwnerOnlyPath('/trackers')).toBe(false);
|
||||
});
|
||||
});
|
||||
27
src/lib/server/owner.ts
Normal file
27
src/lib/server/owner.ts
Normal file
@@ -0,0 +1,27 @@
|
||||
import { error } from '@sveltejs/kit';
|
||||
|
||||
// The site has one owner (Stan). Owner-only data, such as the health tracker, needs both
|
||||
// the admin role and the owner's account email, so granting someone else `admin` (e.g. to
|
||||
// moderate Animaldex) never exposes it. Override with OWNER_EMAIL if the address changes.
|
||||
const OWNER_EMAIL = (process.env.OWNER_EMAIL || 'stan@stanrunge.dev').toLowerCase();
|
||||
|
||||
type OwnerEvent = { locals: App.Locals };
|
||||
|
||||
export function isOwner(event: OwnerEvent): boolean {
|
||||
const user = event.locals.user;
|
||||
return !!user && user.role === 'admin' && user.email?.toLowerCase() === OWNER_EMAIL;
|
||||
}
|
||||
|
||||
/** Owner-only routes answer 404 to everyone else, so they don't reveal that they exist. */
|
||||
export function requireOwner(event: OwnerEvent) {
|
||||
if (!isOwner(event)) error(404, 'Not Found');
|
||||
return event.locals.user!;
|
||||
}
|
||||
|
||||
/** Paths that only the owner may see (checked in hooks.server.ts before any route runs). */
|
||||
export const ownerOnlyPrefixes = ['/trackers/health'] as const;
|
||||
|
||||
export function isOwnerOnlyPath(pathname: string): boolean {
|
||||
const path = pathname.toLowerCase().replace(/\/+$/, '');
|
||||
return ownerOnlyPrefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
|
||||
}
|
||||
Reference in New Issue
Block a user