Implements the 3-tier key model from the multi-person sharing ADR:
each account owns multiple profiles (a person or pet — a 'subject of
care'), and each profile has its own random AES-256-GCM DEK. All
health data is now encrypted under the active profile's DEK, not the
account-wide DEK. The account DEK wraps each profile DEK; the server
stores only opaque wrapped blobs.
Per the ADR: DB wipe, no migration (no real user data). This unblocks
Phase B (sharing) — there is now a per-profile key to wrap to a
recipient's X25519 public key.
Backend:
- Profile model: owner_account_id, kind (human/pet), relationship,
wrapped_profile_dek + iv. ProfileRepository gains find_all_by_owner,
find_by_profile_id_owned, update_profile, delete_profile — all
ownership-scoped.
- Profile handlers: GET/POST /api/profiles, GET/PUT/DELETE
/api/profiles/:id. Removed /api/profiles/me. Renamed users.rs
get_profile/update_profile (the /api/users/me handlers) to
get_account/update_account to resolve a name collision.
- Register accepts default_profile_* fields and auto-creates the self
profile when the client provides a wrapped profile DEK.
- HealthStatistic + Appointment gain profile_id and ?profile_id=
filtering (health stats previously had no profile binding).
- New profile_tests.rs: multi-profile CRUD + ownership isolation +
register-with-default-profile. Fixed the zk health-stat test to
send the now-required profile_id.
Frontend:
- crypto/keys.ts: generateProfileDek, wrapProfileDek, unwrapProfileDek
+ in-memory per-profile DEK store with an active-profile concept.
- useProfileStore rewritten: holds profiles[], activeProfileId;
loadProfiles unwraps each profile DEK; create/update/delete. All 11
encrypt/decrypt sites switched from getEncKey() to
getActiveProfileDek(). load actions pass ?profile_id= so only the
active profile's rows come back.
- ProfileEditor rewritten for the new store (edit active profile,
create/delete). New ProfileSwitcher in the Dashboard AppBar.
- MedicationManager / AppointmentsManager use the active profile id
instead of the hardcoded profile_<user_id>.
- 2 new crypto tests for per-profile DEK isolation; updated store +
component tests for the active-profile-DEK model.
Verification: backend cargo build/clippy/fmt green, tests compile
(integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 30/30 tests pass.
Closes nothing yet (Phase B/C/D remain). Refs #3.
Three workstreams, all backend+frontend (per scope decisions):
Dose logging + real adherence (backend + frontend):
* log_dose now returns the created dose (201 + body) instead of an empty 201.
* get_adherence implemented for real: queries the medication_doses collection
over the last 30 days, counts taken vs total, computes the rate. The previous
implementation hardcoded zeros. Removed the dead calculate_adherence stub.
* Frontend: fixed DoseLog type to match backend MedicationDose (taken:bool,
loggedAt, camelCase); added AdherenceStats + LogDoseRequest types; logDose() +
getAdherence() in api.ts; loadAdherence/logDose actions in the medication
store (adherence cache keyed by med id); new DoseLogger component (Taken/
Skipped buttons + LinearProgress adherence bar) embedded in each
MedicationManager card.
Profile management (backend + frontend):
* New GET/PUT /api/profiles/me endpoints (ProfileResponse excludes encryption
fields; find_by_user_id + update_name on ProfileRepository).
* Register auto-creates a default 'patient' profile (deterministic profile_id =
profile_<user_id>) — this is the contract the frontend relies on.
* Frontend: Profile type; getProfile()/updateProfileName() in api.ts; useProfileStore;
new ProfileEditor component (view/edit name, shows role) as a 4th Dashboard tab.
* Resolved the MedicationManager profile_id TODO: now derives profile_<user_id>
instead of the 'default' fallback.
* NOTE: profile name is stored plaintext (the model anticipates encryption via
nameIv/nameAuthTag but no crypto layer is implemented yet — TODO).
Vitest tests:
* Added @testing-library/user-event; setupTests clears localStorage + cleanup
between tests; new test/mockStore.ts helper (mocks the co-located stores,
handles both selector and no-selector call patterns).
* 5 test files, 20 tests: SeverityChip (4), useMedicationStore actions incl.
loadMedications/createMedication/logDose (4), MedicationManager render+dialog
(5), InteractionsChecker selection+results (4), HealthStats table+dialog (3).
Verified: backend cargo fmt/build/clippy 0 warnings, 19 unit tests pass;
frontend npm build clean, 20 vitest tests pass. Solaria round-trip confirmed:
profile auto-created on register (GET /profiles/me), PUT updates name, dose log
returns the dose body, adherence computes 66.7% for 2-taken/1-skipped.
KNOWN FOLLOW-UP (separate task): the backend Medication list response is deeply
nested + camelCase + stores fields inside medicationData.data; the frontend
Medication type assumes flat top-level snake_case fields. This pre-dates Phase 3c
and affects the whole MedicationManager — needs a backend serialization fix or a
frontend adapter.
goose