Summary

Addresses three safety-critical issues identified in upstream review (nightscout#8447, nightscout#8421):

• ObjectID coercion guard (lib/server/query.js): updateIdQuery crashed on UUID-format _id values. Now validates 24-char hex pattern before coercing to ObjectID.
• Auth failure delay bypass (lib/authorization/delaylist.js): authFailDelay = 0 was silently accepted via || 5000 fallback, eliminating brute-force protection. Replaced with explicit positive-finite guard.
• Device status refactor (lib/server/devicestatus.js): Replaced serial insertOne loop with insertMany. Added truncatePredictions(obj, maxSize) to cap prediction arrays at 288 points (24h × 5min), preventing MongoDB 16MB document limit breach. Modernized remove to deleteMany.
• Boot sequence update (lib/server/bootevent.js): Updated call signature to match refactored devicestatus module.

Design Control Impact

This PR affects the following design control areas:

Modified Requirements

• Query handling: ObjectID validation rules (new regex guard for 24-char hex)
• Authentication: Auth failure delay specification (explicit positive-finite guard, no longer accepts 0)
• Device status storage: Batch insertion, prediction truncation at 288 data points

New Test Cases Needed

• ObjectID coercion: valid hex → ObjectID, UUID → passthrough (2 tests included in tests/query.test.js)
• truncatePredictions boundary conditions (at/below/above 288 points)
• insertMany batch behavior vs. former serial insertOne
• authFailDelay with values: 0, positive integer, missing/undefined, non-numeric

Test Modifications

• Existing devicestatus tests may need signature updates (storage(collection, ctx) → storage(env, ctx))

Risk Items

• Security: Auth delay bypass allowed brute-force attacks (URGENT)
• Reliability: Server crash on UUID-format IDs from certain data sources
• Data integrity: Unbounded prediction arrays could exceed MongoDB 16MB document limit

Files Changed (5)