Harden auth and ingestion privacy/reliability paths - #175

Merged

BigSimmo merged 15 commits into

mainfrom

feature/sprint-2

Jul 2, 2026

Commits on Jul 2, 2026

Add triage security/reliability design spec
BigSimmo
and
Copilot
committed
2c30471
fix(auth): require real user token for private routes
BigSimmo
committed
9142497
test(auth): align local-no-auth tests with fail-closed behavior
BigSimmo
committed
82e27ef
fix(auth): remove client token persistence assumptions (Fixes #53)
BigSimmo
committed
c350c96
fix(auth): restore bearer header helper for private API calls
BigSimmo
committed
eae6bd9
fix(privacy): redact identifiers from persisted image captions
BigSimmo
committed
c30a8a5
fix(privacy): redact cached captions before persistence
BigSimmo
committed
2e2a7d0
fix(logging): redact Supabase-related runtime errors
BigSimmo
committed
8ab17c6
fix(ingestion): enforce embedding dimension from runtime config (Fixes #56)
BigSimmo
committed
2d65a68
fix(privacy): preserve clinical ranges and redact caption metadata paths
BigSimmo
committed
c2342bb
fix(privacy): redact spaced MRN/NHS caption identifiers
BigSimmo
committed
741be6f
chore(sdd): stop tracking local task report artifact
BigSimmo
committed
1c78f0c
fix(logging): redact modern supabase key formats in safe logs
BigSimmo
committed
92cd8ac
test(logging): avoid gitleaks false positive fixture
BigSimmo
and
Copilot
committed
2b12c58
chore: ignore gitleaks false positive on redaction-test fixture
BigSimmo
and
claude
committed
6f90db2