No description
cf6fcd4ef2
Refresh-token rotation bug (found via Solaria smoke test): * RefreshClaims now carries a unique random jti (UUID v4). Without it, two refresh tokens issued in the same second (e.g. on rotation) were byte-identical — breaking rotation, colliding on the tokenHash unique index, and making a stolen old token indistinguishable from the new one. Every refresh token is now unique regardless of issue time. Added a unit test asserting consecutive tokens differ. Code cleanup (review items): * #15: removed unused deps tower_governor, slog, thiserror (zero refs in src/). * #30: deleted leftover src/main.rs.restore (a stale git-error-message backup). * #28: removed the 9 single-line-comment stub files under src/db/ (appointment, family, health_data, lab_result, medication, profile, permission, share, user) and their mod declarations; nothing referenced them, real logic lives in mongodb_impl.rs/init.rs. * #29: stripped 61 broad module-level #![allow(...)] suppressions across src/. Fixed the surfaced warnings instead: 4 unused 'claims' extractor bindings -> _claims; removed dead OpenFDAService.client/base_url fields + the never-called query_drug_events method + unused HashMap/reqwest imports; applied clippy's mechanical fixes (Ok(?) -> ?, Copy ObjectId clone, redundant closures, useless conversions); rewrote 'if let Ok(_) = x' -> 'if x.is_ok()'. Result: cargo build + clippy --all-targets are warning-free with no blanket allows. Verified: fmt clean, build clean, clippy 0 warnings, 19 unit tests pass (was 18; +1 jti-uniqueness test). |
||
|---|---|---|
| .forgejo/workflows | ||
| backend | ||
| docs | ||
| scripts | ||
| web/normogen-web | ||
| .cursorrules | ||
| .gitignore | ||
| .gooserules | ||
| README.md | ||
Normogen
Normogen (Mapudungun for "Balanced Life") is an open-source health data platform for private, secure health data management.
📚 Documentation
All project documentation has been organized into the docs/ directory:
- Documentation Index - Start here for complete documentation
- Product Overview - Project introduction and features
- Quick Start - Get started quickly
- API Documentation - Backend API reference
🚀 Quick Start
# Clone repository
git clone <forgejo-url> normogen
cd normogen/backend
# Setup configuration
cp .env.example .env
# Edit .env with your values
# Run with Docker Compose
docker compose up -d
# Check status (default port is 6500 via NORMOGEN_PORT; Solaria maps it to host 6800)
curl http://localhost:6500/health
📊 Current Status
- Backend: ✅ Phase 2.x feature-complete (Rust + Axum + MongoDB), including drug interactions (Phase 2.8). Security-hardened: token-version validation, hashed refresh-token persistence, fail-fast config, real-IP audit logging. Deployed on Solaria.
- Frontend: 🚧 Early (React + TypeScript) — Login/Register pages + API/store layer exist; router not yet wired.
- Tests: 18 unit + 13 integration (auth + medication), CI-gated with MongoDB.
- Deployment: Docker on Solaria (image built manually — CI can't run DinD on Forgejo).
- See docs/product/STATUS.md for the full breakdown.
🗂️ Documentation Structure
docs/
├── product/ # Product definition, features, roadmap
├── implementation/ # Phase plans, specs, progress reports
├── testing/ # Test scripts and results
├── deployment/ # Deployment guides and scripts
├── development/ # Git workflow, CI/CD, development tools
└── archive/ # Historical documentation
📖 Full Documentation
See the Documentation Index for complete project documentation.
Last Updated: 2026-06-27