fix: resolve 29 audit findings across clinical safety, privacy, worker, and api domains

docs/branch-review-records/209b08a93bea5954ac3af3034d10c056a50f6b4dde3771c74ad6bebb83b4ea44.record.md

@@ -0,0 +1 @@
+| 2026-08-18 | claude/issues-reconcile-2026-08-19 | b393cdd530e81d6bfbdc15c495d870b57c73f01b | Serialized reconcile of 21 queued outstanding-issues inbox requests (PR #2168) | approved — documentation-only; canonical diff equals the recorded reconciliation transaction | check:outstanding-issues passed (392 rows, 57 open); check:ledger-write-discipline passed b400b138f8c1..HEAD; format:changed clean; inbox 0 pending / 391 applied |

src/app/api/answer/route.ts

@@ -182,7 +182,8 @@ export async function POST(request: Request) {
  }
  if (error instanceof Error) {
  const fallbackBody = body;
- const fallbackReason = fallbackBody ? nonProductionSupabaseDemoFallbackReason(error) : null;
+ const fallbackReason =
+ fallbackBody && process.env.NODE_ENV !== "production" ? nonProductionSupabaseDemoFallbackReason(error) : null;
  if (fallbackBody && fallbackReason) {
  return NextResponse.json(
  { ...buildDemoAnswerPayload(fallbackBody, fallbackReason), interactionId },

src/app/api/differentials/[slug]/route.ts

@@ -126,13 +126,15 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
  const fetchRecord = async () => {
  const { data, error } = await supabase
  .from("differential_records")
- .select("*")
+ .select(
+ "id,owner_id,kind,slug,title,subtitle,status,clinical_hinge,tags,payload,source,source_status,validation_status,last_reviewed_at,review_due_at,created_at,updated_at",
+ )
  .eq("owner_id", access.ownerId)
  .eq("kind", kind)
  .eq("slug", normalizedSlug)
  .maybeSingle();
  if (error) throw new Error(error.message);
- return (data as DifferentialRecordRow | null) ?? null;
+ return (data as unknown as DifferentialRecordRow | null) ?? null;
  };
 
  let row = await fetchRecord();

src/app/api/documents/[id]/route.ts

@@ -6,6 +6,7 @@ import { env, isDemoMode } from "@/lib/env";
 import { jsonError, PublicApiError } from "@/lib/http";
 import { buildStorageCleanupJobUpdate } from "@/lib/ingestion";
 import { invalidateRagCachesForDocumentMutation } from "@/lib/rag/rag";
+import { clearCachedSignedUrlsForDocument } from "@/lib/signed-url-cache";
 import { createAdminClient } from "@/lib/supabase/admin";
 import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
 import { writeAuditLog } from "@/lib/audit";
@@ -238,6 +239,7 @@ export async function DELETE(request: Request, { params }: { params: Promise<{ i
  if (ledgerWarning) cleanup.storageWarnings.push(ledgerWarning);
 
  invalidateRagCachesForDocumentMutation(user.id, { affectsPublicCorpus: false });
+ clearCachedSignedUrlsForDocument(id);
  await writeAuditLog(supabase, {
  ownerId: user.id,
  action: "document_delete",

src/app/api/documents/route.ts

@@ -220,29 +220,62 @@ export async function GET(request: Request) {
  }
 
  const ownedIds = [...ownedDocumentIds];
- const emptyResult = () => Promise.resolve({ data: [], error: null });
- const [ownedLabelsResult, publicLabelsResult, ownedSummariesResult, publicSummariesResult] = await Promise.all([
- ownedIds.length
- ? supabase.from("document_labels").select(LABEL_LIST_COLUMNS).in("document_id", ownedIds)
- : emptyResult(),
- publicDocumentIds.length
- ? supabase.from("document_labels").select(PUBLIC_LABEL_LIST_COLUMNS).in("document_id", publicDocumentIds)
- : emptyResult(),
- ownedIds.length
- ? supabase.from("document_summaries").select(SUMMARY_LIST_COLUMNS).in("document_id", ownedIds)
- : emptyResult(),
- publicDocumentIds.length
- ? supabase.from("document_summaries").select(PUBLIC_SUMMARY_LIST_COLUMNS).in("document_id", publicDocumentIds)
- : emptyResult(),
+ const ownedLabelsPromises = [];
+ for (let i = 0; i < ownedIds.length; i += 100) {
+ ownedLabelsPromises.push(
+ supabase
+ .from("document_labels")
+ .select(LABEL_LIST_COLUMNS)
+ .in("document_id", ownedIds.slice(i, i + 100)),
+ );
+ }
+ const publicLabelsPromises = [];
+ for (let i = 0; i < publicDocumentIds.length; i += 100) {
+ publicLabelsPromises.push(
+ supabase
+ .from("document_labels")
+ .select(PUBLIC_LABEL_LIST_COLUMNS)
+ .in("document_id", publicDocumentIds.slice(i, i + 100)),
+ );
+ }
+ const ownedSummariesPromises = [];
+ for (let i = 0; i < ownedIds.length; i += 100) {
+ ownedSummariesPromises.push(
+ supabase
+ .from("document_summaries")
+ .select(SUMMARY_LIST_COLUMNS)
+ .in("document_id", ownedIds.slice(i, i + 100)),
+ );
+ }
+ const publicSummariesPromises = [];
+ for (let i = 0; i < publicDocumentIds.length; i += 100) {
+ publicSummariesPromises.push(
+ supabase
+ .from("document_summaries")
+ .select(PUBLIC_SUMMARY_LIST_COLUMNS)
+ .in("document_id", publicDocumentIds.slice(i, i + 100)),
+ );
+ }
+
+ const [ownedLabelsResults, publicLabelsResults, ownedSummariesResults, publicSummariesResults] = await Promise.all([
+ Promise.all(ownedLabelsPromises),
+ Promise.all(publicLabelsPromises),
+ Promise.all(ownedSummariesPromises),
+ Promise.all(publicSummariesPromises),
  ]);
 
- for (const result of [ownedLabelsResult, publicLabelsResult, ownedSummariesResult, publicSummariesResult]) {
- if (result.error) throw new Error(result.error.message);
+ for (const res of [
+ ...ownedLabelsResults,
+ ...publicLabelsResults,
+ ...ownedSummariesResults,
+ ...publicSummariesResults,
+ ]) {
+ if (res.error) throw new Error(res.error.message);
  }
 
  const labelsByDocument = new Map<string, unknown[]>();
  const labelRows = parseListRows(
- [...(ownedLabelsResult.data ?? []), ...(publicLabelsResult.data ?? [])],
+ [...ownedLabelsResults.flatMap((res) => res.data ?? []), ...publicLabelsResults.flatMap((res) => res.data ?? [])],
  labelListRowSchema,
  );
  for (const label of labelRows) {
@@ -253,7 +286,10 @@ export async function GET(request: Request) {
  labelsByDocument.set(label.document_id, existing);
  }
  const summaryRows = parseListRows(
- [...(ownedSummariesResult.data ?? []), ...(publicSummariesResult.data ?? [])],
+ [
+ ...ownedSummariesResults.flatMap((res) => res.data ?? []),
+ ...publicSummariesResults.flatMap((res) => res.data ?? []),
+ ],
  summaryListRowSchema,
  );
  const summariesByDocument = new Map(

src/components/clinical-dashboard/auth-panel.tsx

@@ -44,7 +44,7 @@ const authEmailChangeEvent = "clinical-kb-auth-email-change";
 function getAuthEmailSnapshot() {
  if (typeof window === "undefined") return "";
  try {
- return window.localStorage.getItem(AUTH_EMAIL_STORAGE_KEY) ?? "";
+ return window.sessionStorage.getItem(AUTH_EMAIL_STORAGE_KEY) ?? "";
  } catch {
  return "";
  }

src/components/favourites/favourites-storage.ts

@@ -58,6 +58,8 @@ export function subscribeFavouritesStorage(listener: () => void): () => void {
  };
 }
 
+const FAVOURITES_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+
 export function loadFavouriteLastOpened(): Record<string, number> {
  if (typeof window === "undefined") {
  return getDefaultInitialTimestamps();
@@ -69,7 +71,14 @@ export function loadFavouriteLastOpened(): Record<string, number> {
  if (raw) {
  const parsed = JSON.parse(raw);
  if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
- const result: Record<string, number> = { ...getDefaultInitialTimestamps(), ...parsed };
+ const now = Date.now();
+ const pruned: Record<string, number> = {};
+ for (const [key, ts] of Object.entries(parsed)) {
+ if (typeof ts === "number" && Number.isFinite(ts) && now - ts < FAVOURITES_TTL_MS) {
+ pruned[key] = ts;
+ }
+ }
+ const result: Record<string, number> = { ...getDefaultInitialTimestamps(), ...pruned };
  inMemoryLastOpened = result;
  return result;
  }

src/lib/answer-telemetry.ts

@@ -148,3 +148,22 @@ export async function logAnswerDiagnostics(args: {
  }
  }
 }
+
+export const DEFAULT_RETRIEVAL_LOG_RETENTION_DAYS = 90;
+
+export async function pruneExpiredRetrievalLogs(
+ supabase: ReturnType<typeof createAdminClient>,
+ retentionDays: number = DEFAULT_RETRIEVAL_LOG_RETENTION_DAYS,
+): Promise<{ deletedCount: number | null; error: Error | null }> {
+ try {
+ const cutoffDate = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString();
+ const { count, error } = await supabase
+ .from("rag_retrieval_logs")
+ .delete({ count: "exact" })
+ .lt("created_at", cutoffDate);
+ if (error) throw new Error(error.message);
+ return { deletedCount: count, error: null };
+ } catch (err) {
+ return { deletedCount: null, error: err instanceof Error ? err : new Error(String(err)) };
+ }
+}

src/lib/answer-thread-storage.ts

@@ -72,7 +72,14 @@ function isStoredAnswerTurn(value: unknown): value is StoredAnswerTurn {
  Boolean(turn.answer) &&
  typeof turn.answer === "object" &&
  typeof turn.answer.answer === "string" &&
- Array.isArray(turn.sources)
+ Array.isArray(turn.sources) &&
+ turn.sources.every(
+ (source) =>
+ Boolean(source) &&
+ typeof source === "object" &&
+ typeof source.id === "string" &&
+ typeof source.document_id === "string",
+ )
  );
 }
 

src/lib/audit.ts

@@ -5,7 +5,13 @@ import { logger } from "@/lib/logger";
 // failing to record an audit row must never break or roll back the operation it
 // describes, so failures are logged, not thrown.
 
-export type AuditAction = "document_upload" | "document_delete" | "document_rename" | "document_label_change";
+export type AuditAction =
+ | "document_upload"
+ | "document_delete"
+ | "document_rename"
+ | "document_label_change"
+ | "source_review_change"
+ | "bulk_reindex";
 
 export type AuditLogEntry = {
  ownerId: string;
@@ -48,6 +54,8 @@ function minimumAuditMetadata(entry: AuditLogEntry): Record<string, boolean | nu
  }
  case "document_rename":
  case "document_label_change":
+ case "source_review_change":
+ case "bulk_reindex":
  return {};
  }
 }

src/lib/clinical-safety.ts

@@ -15,7 +15,7 @@ const safetyPatterns: Array<{ kind: SafetyFindingKind; label: string; pattern: R
  {
  kind: "contraindication",
  label: "Contraindication",
- pattern: /\b(contraindicat|do not use|avoid|not recommended|must not)\b/i,
+ pattern: /\b(contraindicat\w*|do not use|avoid|not recommended|must not)\b/i,
  },
  {
  kind: "red_flag",

src/lib/corpus-grounding.ts

@@ -66,9 +66,11 @@ const termStatsCacheTtlMs = 10 * 60 * 1000;
 const termStatsCacheMaxEntries = 1024;
 
 const termStatsCache = new Map<string, { expiresAt: number; stats: CorpusTopicTermStats }>();
+const inFlightGroundingQueries = new Map<string, Promise<CorpusTopicTermStats[]>>();
 
 export function resetCorpusGroundingCacheForTests() {
  termStatsCache.clear();
+ inFlightGroundingQueries.clear();
 }
 
 function cacheKey(ownerScopeKey: string, term: string) {
@@ -156,54 +158,63 @@ export async function classifyCorpusGrounding(args: {
  }
 
  if (missing.length > 0) {
+ const flightKey = `${ownerScopeKey}:${[...missing].sort().join(",")}`;
  try {
- const ownerFilter = accessScope.ownerId ?? PUBLIC_OWNER_FILTER_SENTINEL;
- const versioned = await resolveAbortableQuery(
- args.supabase.rpc("corpus_topic_term_stats_v2", {
- terms: missing,
- owner_filter: ownerFilter,
- include_public: accessScope.includePublic,
- }),
- args.signal,
- );
- const calls =
- !versioned || isMissingRetrievalRpcError(versioned.error)
- ? await Promise.all([
- resolveAbortableQuery(
- args.supabase.rpc("corpus_topic_term_stats", { terms: missing, owner_filter: ownerFilter }),
- args.signal,
- ),
- accessScope.ownerId && accessScope.includePublic
- ? resolveAbortableQuery(
- args.supabase.rpc("corpus_topic_term_stats", {
- terms: missing,
- owner_filter: PUBLIC_OWNER_FILTER_SENTINEL,
- }),
- args.signal,
- )
- : Promise.resolve({ data: [], error: null }),
- ])
- : [versioned];
- if (calls.some((call) => call.error)) throw calls.find((call) => call.error)?.error;
- const byTerm = new Map<string, CorpusTopicTermStats>();
- for (const call of calls) {
- for (const row of (call.data ?? []) as CorpusTopicTermStats[]) {
- const current = byTerm.get(row.term);
- byTerm.set(
- row.term,
- current
- ? {
- term: row.term,
- has_ts_signal: current.has_ts_signal || row.has_ts_signal,
- title_doc_count: current.title_doc_count + row.title_doc_count,
- chunk_present: current.chunk_present || row.chunk_present,
- total_doc_count: current.total_doc_count + row.total_doc_count,
- }
- : row,
+ let flight = inFlightGroundingQueries.get(flightKey);
+ if (!flight) {
+ flight = (async () => {
+ const ownerFilter = accessScope.ownerId ?? PUBLIC_OWNER_FILTER_SENTINEL;
+ const versioned = await resolveAbortableQuery(
+ args.supabase.rpc("corpus_topic_term_stats_v2", {
+ terms: missing,
+ owner_filter: ownerFilter,
+ include_public: accessScope.includePublic,
+ }),
+ args.signal,
  );
- }
+ const calls =
+ !versioned || isMissingRetrievalRpcError(versioned.error)
+ ? await Promise.all([
+ resolveAbortableQuery(
+ args.supabase.rpc("corpus_topic_term_stats", { terms: missing, owner_filter: ownerFilter }),
+ args.signal,
+ ),
+ accessScope.ownerId && accessScope.includePublic
+ ? resolveAbortableQuery(
+ args.supabase.rpc("corpus_topic_term_stats", {
+ terms: missing,
+ owner_filter: PUBLIC_OWNER_FILTER_SENTINEL,
+ }),
+ args.signal,
+ )
+ : Promise.resolve({ data: [], error: null }),
+ ])
+ : [versioned];
+ if (calls.some((call) => call.error)) throw calls.find((call) => call.error)?.error;
+ const byTerm = new Map<string, CorpusTopicTermStats>();
+ for (const call of calls) {
+ for (const row of (call.data ?? []) as CorpusTopicTermStats[]) {
+ const current = byTerm.get(row.term);
+ byTerm.set(
+ row.term,
+ current
+ ? {
+ term: row.term,
+ has_ts_signal: current.has_ts_signal || row.has_ts_signal,
+ title_doc_count: current.title_doc_count + row.title_doc_count,
+ chunk_present: current.chunk_present || row.chunk_present,
+ total_doc_count: current.total_doc_count + row.total_doc_count,
+ }
+ : row,
+ );
+ }
+ }
+ return [...byTerm.values()];
+ })();
+ inFlightGroundingQueries.set(flightKey, flight);
  }
- const rows = [...byTerm.values()];
+
+ const rows = await flight;
  // A term the RPC did not echo back got dropped SQL-side (blank after trim); treat the
  // whole classification as inconclusive rather than guessing.
  if (rows.length !== missing.length) return { verdict: "inconclusive", anchorTerms: [], absentTerms: [] };
@@ -217,6 +228,8 @@ export async function classifyCorpusGrounding(args: {
  // Fail open: missing RPC (migration not applied), transient DB error, demo mode — the
  // caller keeps today's behaviour (LLM classifier fallback + soft-tail short-circuit).
  return { verdict: "inconclusive", anchorTerms: [], absentTerms: [] };
+ } finally {
+ inFlightGroundingQueries.delete(flightKey);
  }
  }
 

src/lib/logger.ts

@@ -13,9 +13,12 @@ const MAX_DEPTH = 5;
 const SENSITIVE_KEY =
  /authorization|cookie|token|secret|api[-_]?key|password|service[-_]?role|email|\bquery\b|prompt|\bcontent\b|\banswer\b|patient|\bmrn\b/i;
 
+const SENSITIVE_VALUE_PATTERN = /\b(?:mrn|ur|unit\s*no\.?)\s*[:#]?\s*\d{6,10}\b|\b\d{3}\s\d{3}\s\d{4}\b/i;
+
 function redactValue(value: unknown, depth: number): unknown {
  if (value === null || value === undefined) return value;
  if (typeof value === "string") {
+ if (SENSITIVE_VALUE_PATTERN.test(value)) return REDACTED;
  return value.length > MAX_STRING_LENGTH ? `${value.slice(0, MAX_STRING_LENGTH)}…[truncated]` : value;
  }
  if (typeof value === "number" || typeof value === "boolean") return value;