Daniel a7132c218e feat: a ciphertext now only decrypts in the row it was written for ... enc1 said what a value was but not where it belonged. The blob in one user's nextcloud_token would decrypt perfectly if copied onto another user's row, and that account's exports would then go into someone else's storage. Nothing about the ciphertext objected. Adds enc2, which binds a context string — 'users:nextcloud_token:41' — as AES-GCM additional authenticated data. The auth tag covers it, so a moved ciphertext fails to open rather than opening somewhere wrong. The context is authenticated, not encrypted: it is not a secret, it is a claim about location. enc1 is still read, unchanged and forever — every existing row is enc1. Bound rows are distinguishable (isBound), so the Nextcloud token is rebound in place the next time it is successfully used, the same way a legacy plaintext one was already upgraded. That gate moved from isEncrypted to isBound; isEncrypted is true for enc1, so it would have skipped exactly the rows that need rebinding. Bound so far: Nextcloud app passwords, and invite codes — which bind to their own code_hash, since unlike the row id that exists at INSERT time. Decrypting an invite moved into list(), so the cipher and the hash that opens it no longer leave the module together. Mutation-tested: dropping the AAD, dropping the guard, gating on isEncrypted, or dropping a context at a call site each fail a test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU		2026-09-12 21:25:24 +02:00
..
account-boundary.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
admin-clinical-assistant-wiring.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
admin-docs-toc.test.js	test docs toc links	2026-05-09 01:33:06 +02:00
assistant-attachment-roundtrip.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-autosave.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-citation-modal.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-citations.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
assistant-component-css.test.js	refactor: drop the "Saved Chats" header and collapse arrow from the rail	2026-09-10 13:27:29 +02:00
assistant-enter-to-send.test.js	feat: Enter sends in the assistant, and the person chooses	2026-09-12 18:05:36 +02:00
assistant-export-owner.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-image-attachments.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-image-done.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-image-intent.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-math-mhchem.test.js	fix: reviewer findings — mhchem macro wrapping, regenerate history dedupe, strict safe image allowlist, stale docs	2026-09-08 19:25:31 +02:00
assistant-message-actions.test.js	fix: send button morphs into a clickable STOP icon while working (no more disabled spinner); grouped bottom-left tools; silent-recording message; completed images auto-join the library; transient image-status retries	2026-09-09 04:12:30 +02:00
assistant-mobile.test.js	fix: recordings that produced nothing, and the boxes that zoomed on iOS	2026-09-11 00:16:19 +02:00
assistant-saved-tables.test.js	feat: saved chats grouped by recency, a visible sidebar toggle, and acknowledgements answered cheaply	2026-09-09 18:59:45 +02:00
assistant-sharing-boundary.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-sources-cleaning.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
assistant-translate.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-user-markdown.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-voice-mode.test.js	fix: voice mode reads the answer that just arrived, and reads what the page shows	2026-09-11 21:10:50 +02:00
assistant-voice.test.js	fix: OWUI-style polish — fullscreen workspace replaces main menu, row-click saved chats (delete stays as hover), markdown-rendered patient handout, admin-only raw transcript, /api TTS URL, scrollable unclipped tables, action buttons hidden in exports, autosave-only copy	2026-09-08 22:41:08 +02:00
assistant-workspace-layout.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
attachment-magic-bytes.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
backend-hardening.test.js	chore: checkpoint before AAD binding and incremental streaming render	2026-09-12 21:17:35 +02:00
bedside-respiratory-ventilation.test.js	allow bedside respiratory without weight	2026-05-08 09:10:33 +02:00
build-id.test.js	feat: a deploy you can repeat, and prove afterwards	2026-09-11 00:41:11 +02:00
calc-math.test.js	feat: B — extract drug data to public/data/drugs.json (schema v1.0)	2026-04-20 04:23:24 +02:00
calculators-data.test.js	consolidate calculator growth helpers	2026-05-08 04:36:39 +02:00
chat-model-discovery-filter.test.js	wip: invite codes stay copyable	2026-09-12 21:00:22 +02:00
clinical-assistant-prompt-pool.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-conversation.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
clinical-generation-options.test.js	Send reasoning options only to supported model	2026-08-27 21:25:38 +02:00
clinical-mcp-session-lifecycle.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-notes-entrypoints.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-release-integration.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
clinical-retrieval-title.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-table-preservation.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
corpus-retrieval.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
crypto-context-binding.test.js	feat: a ciphertext now only decrypts in the row it was written for	2026-09-12 21:25:24 +02:00
deck-review.test.js	feat: modifying a deck can see it	2026-09-12 06:55:16 +02:00
deck-themes.test.js	feat: deck themes — a palette you pick, previewed by the renderer itself	2026-09-12 19:40:19 +02:00
doc-spec.test.js	feat: Word is built by python-docx from the same typed source as the deck	2026-09-11 21:58:53 +02:00
e2e-harness.test.js	test(e2e): repair the harness, taking the browser suite from 96 failures to 11	2026-09-11 18:54:03 +02:00
embeddings-provider.test.js	fix litellm metadata model discovery	2026-05-09 04:46:06 +02:00
empty-answer.test.js	fix: an empty answer from the model was the one failure never caught	2026-09-12 07:41:04 +02:00
extension-transfer.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
frontend-prompt-env.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
frontend-rendering-safety.test.js	feat: the announcement banner renders Markdown, safely	2026-09-10 19:08:12 +02:00
generated-image-cache.test.js	feat: an image library — every picture this account has made	2026-09-12 14:36:30 +02:00
generated-image-storage.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
generated-image-tools.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
generated-images-ui.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
image-fallback-chain.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
image-key-collision.test.js	fix: a second deck reused the first deck's pictures	2026-09-12 08:26:09 +02:00
image-library.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
login-codes.test.js	feat: sign in with a code emailed to you, offered beside the password	2026-09-11 20:12:03 +02:00
mcp-shutdown.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
metrics.test.js	fix metrics route normalization	2026-05-08 20:22:14 +02:00
model-defaults.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
model-roster-pruning.test.js	feat: send a resource to your own Nextcloud, as the rendered file	2026-09-12 20:34:58 +02:00
models-changed-propagation.test.js	fix: a newly added model reaches every picker, including the user-facing ones	2026-09-12 17:46:18 +02:00
module-entrypoints.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
my-resources-refine.test.js	feat: send a resource to your own Nextcloud, as the rendered file	2026-09-12 20:34:58 +02:00
my-resources-stale-results.test.js	fix: the last run's illustration no longer sits under an empty form	2026-09-12 17:43:19 +02:00
my-resources.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
nextcloud-login-flow.test.js	feat: a ciphertext now only decrypts in the row it was written for	2026-09-12 21:25:24 +02:00
notes-sanitize.test.js	fix diagram delete confirmation	2026-05-08 06:28:12 +02:00
patient-takehome.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
pe-guide-data.test.js	move pe guide data to json	2026-05-08 08:56:21 +02:00
policy-flows.test.js	feat: connect Nextcloud by signing in to Nextcloud	2026-09-12 20:55:00 +02:00
policy-ui.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
prompt-administration.test.js	fix: mobile layout regression, workspace menu in the assistant rail, prompt as principles	2026-09-09 22:24:10 +02:00
release.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
resource-to-nextcloud.test.js	feat: a ciphertext now only decrypts in the row it was written for	2026-09-12 21:25:24 +02:00
review-model-vision-guard.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
session-quiz-ed-regressions.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
slide-shapes.test.js	feat: record what a deck wanted and could not have	2026-09-11 22:51:15 +02:00
slide-spec.test.js	fix: a deck the model fumbles once is asked for again, not abandoned	2026-09-12 05:34:14 +02:00
stt-provider.test.js	simplify speech and embeddings through litellm	2026-05-09 05:09:02 +02:00
transcription-memory-policy.test.js	feat: a retried transcript goes back to the tab the audio came from	2026-09-11 12:39:50 +02:00
tts-provider.test.js	chore: Kitten and Supertonic retired; Kokoro is the local voice	2026-09-12 16:45:05 +02:00
vision-tool.test.js	fix: the active library view is unmistakable, and a leading question cannot mislead the vision model	2026-09-12 16:27:21 +02:00
web-search.test.js	feat: My Resources says what it is, offers its sources in one place, and Modify gets them too	2026-09-11 18:54:17 +02:00
well-visit-data.test.js	remove legacy well visit schedule data	2026-05-08 08:59:23 +02:00