Daniel cc76c66953 fix: the signed-out preview never worked, because /api was gated wholesale ... Eleven routers are mounted on '/api' and called router.use(authMiddleware) with no path. Mounted that way, the gate applies to every /api request that reaches the router — including routes belonging to routers mounted further down server.js. extensions.js did it from line 295; the assistant is mounted at 305. So a signed-out request to /api/clinical-assistant/status was refused ten lines before the preview middleware could look at it, whatever the admin setting said. server.js line 250 already warned about this shape. Each gate now names its own prefix, so a router protects its own routes and nothing else. Verified afterwards that every namespace which must stay shut still answers 401 signed out: extensions, encounters, memories, notes, diagrams, generated images, image jobs, documents, audio backups, ED encounters, don't-miss, patient education, billing, well visit, admin, transcribe and the rest. Two of these routers were gating routes nobody realised they were gating. Second defect in the same path: authMiddleware only ever looks for a token, so calling it unconditionally after the preview identity had been assigned rejected exactly the requests preview exists to serve. Only that identity may skip it; authMiddleware stays strict everywhere else. Preview now answers with a real cited answer, and stays as narrow as it was designed to be — four allow-listed paths, no identity, nothing ownable. A test now walks every /api router and fails on a blanket gate, which is how the last six were found. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU		2026-09-11 02:00:59 +02:00
..
account-boundary.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
admin-clinical-assistant-wiring.test.js	fix: drop the dead admin jump links; stop a test flake at its source	2026-09-10 15:16:47 +02:00
admin-docs-toc.test.js	test docs toc links	2026-05-09 01:33:06 +02:00
assistant-attachment-roundtrip.test.js	fix: translated answers keep their source chips; the patient take home can be translated	2026-09-09 18:40:23 +02:00
assistant-autosave.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-citation-modal.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-citations.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
assistant-component-css.test.js	refactor: drop the "Saved Chats" header and collapse arrow from the rail	2026-09-10 13:27:29 +02:00
assistant-export-owner.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-image-attachments.test.js	refactor: the model decides about acknowledgements and images, not route heuristics	2026-09-09 19:06:28 +02:00
assistant-image-done.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-image-intent.test.js	fix: mobile layout regression, workspace menu in the assistant rail, prompt as principles	2026-09-09 22:24:10 +02:00
assistant-math-mhchem.test.js	fix: reviewer findings — mhchem macro wrapping, regenerate history dedupe, strict safe image allowlist, stale docs	2026-09-08 19:25:31 +02:00
assistant-message-actions.test.js	fix: send button morphs into a clickable STOP icon while working (no more disabled spinner); grouped bottom-left tools; silent-recording message; completed images auto-join the library; transient image-status retries	2026-09-09 04:12:30 +02:00
assistant-mobile.test.js	fix: recordings that produced nothing, and the boxes that zoomed on iOS	2026-09-11 00:16:19 +02:00
assistant-preview.test.js	feat: display-only sources toggle, signed-out preview, and a composer that carries the toolbar	2026-09-10 04:12:36 +02:00
assistant-saved-tables.test.js	feat: saved chats grouped by recency, a visible sidebar toggle, and acknowledgements answered cheaply	2026-09-09 18:59:45 +02:00
assistant-sharing-boundary.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-sources-cleaning.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
assistant-translate.test.js	fix: translate as HTML so tables and emphasis survive; stop repeat image generation	2026-09-09 18:49:58 +02:00
assistant-user-markdown.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-voice.test.js	fix: OWUI-style polish — fullscreen workspace replaces main menu, row-click saved chats (delete stays as hover), markdown-rendered patient handout, admin-only raw transcript, /api TTS URL, scrollable unclipped tables, action buttons hidden in exports, autosave-only copy	2026-09-08 22:41:08 +02:00
assistant-workspace-layout.test.js	feat: a recording survives switching to the Assistant, and signing out keeps it	2026-09-10 16:54:01 +02:00
backend-hardening.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
bedside-respiratory-ventilation.test.js	allow bedside respiratory without weight	2026-05-08 09:10:33 +02:00
build-id.test.js	feat: a deploy you can repeat, and prove afterwards	2026-09-11 00:41:11 +02:00
calc-math.test.js	feat: B — extract drug data to public/data/drugs.json (schema v1.0)	2026-04-20 04:23:24 +02:00
calculators-data.test.js	consolidate calculator growth helpers	2026-05-08 04:36:39 +02:00
clinical-assistant-prompt-pool.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-conversation.test.js	feat: one menu for both views, a slim top bar, and an account card	2026-09-10 04:45:51 +02:00
clinical-generation-options.test.js	Send reasoning options only to supported model	2026-08-27 21:25:38 +02:00
clinical-mcp-session-lifecycle.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-notes-entrypoints.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-release-integration.test.js	feat: display-only sources toggle, signed-out preview, and a composer that carries the toolbar	2026-09-10 04:12:36 +02:00
clinical-retrieval-title.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-table-preservation.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
embeddings-provider.test.js	fix litellm metadata model discovery	2026-05-09 04:46:06 +02:00
extension-transfer.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
frontend-prompt-env.test.js	feat: display-only sources toggle, signed-out preview, and a composer that carries the toolbar	2026-09-10 04:12:36 +02:00
frontend-rendering-safety.test.js	feat: the announcement banner renders Markdown, safely	2026-09-10 19:08:12 +02:00
generated-image-cache.test.js	perf: store real image previews in MinIO, generated at creation and on demand	2026-09-10 06:39:30 +02:00
generated-image-storage.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
generated-image-tools.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
generated-images-ui.test.js	fix: correct a false Settings claim; make every test child's stdout pure TAP	2026-09-10 15:41:44 +02:00
generated-images.integration.js	test: offbox image is session-only in the durable pipeline integration	2026-09-07 16:59:15 +02:00
learning-hub-ai-category.test.js	extract learning hub cms controller	2026-05-08 16:23:01 +02:00
learning-hub-ai-panel-controller.test.js	extract learning hub ai panel controller	2026-05-08 16:54:48 +02:00
learning-hub-editor.test.js	extract learning hub ai panel controller	2026-05-08 16:54:48 +02:00
learning-hub-manual-category.test.js	fix: make manual CMS category creation visible and keyboard-accessible	2026-09-07 01:16:40 +02:00
learning-hub-quiz-controller.test.js	extract learning hub quiz controller	2026-05-08 16:38:51 +02:00
learning-hub-webdav-controller.test.js	extract learning hub webdav controller	2026-05-08 16:44:02 +02:00
mcp-shutdown.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
metrics.test.js	fix metrics route normalization	2026-05-08 20:22:14 +02:00
model-defaults.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
module-entrypoints.test.js	convert learning hub to module	2026-05-08 09:01:34 +02:00
notes-sanitize.test.js	fix diagram delete confirmation	2026-05-08 06:28:12 +02:00
patient-takehome.test.js	fix: translate as HTML so tables and emphasis survive; stop repeat image generation	2026-09-09 18:49:58 +02:00
pe-guide-data.test.js	move pe guide data to json	2026-05-08 08:56:21 +02:00
policy-flows.test.js	fix: the signed-out preview never worked, because /api was gated wholesale	2026-09-11 02:00:59 +02:00
policy-ui.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
prompt-administration.test.js	fix: mobile layout regression, workspace menu in the assistant rail, prompt as principles	2026-09-09 22:24:10 +02:00
release.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
session-quiz-ed-regressions.test.js	fix: correct a false Settings claim; make every test child's stdout pure TAP	2026-09-10 15:41:44 +02:00
stt-provider.test.js	simplify speech and embeddings through litellm	2026-05-09 05:09:02 +02:00
transcription-memory-policy.test.js	fix: recordings that produced nothing, and the boxes that zoomed on iOS	2026-09-11 00:16:19 +02:00
tts-provider.test.js	Match TTS voices to the selected LiteLLM model	2026-07-30 17:34:34 +02:00
well-visit-data.test.js	remove legacy well visit schedule data	2026-05-08 08:59:23 +02:00