Commit graph

162 commits

Author SHA1 Message Date
724a914fa7 Add debug 2026-05-17 10:43:32 +05:30
a2bc6b6857 Simplify admin stats 2026-05-17 09:47:36 +05:30
c11484b910 Fix rate limit variable scope 2026-05-17 01:14:32 +05:30
e47001365e Rate limit controlled via RATE_LIMIT_ENABLED env 2026-05-17 01:12:15 +05:30
f84ee96e2b Enhanced debug 2026-05-17 00:52:39 +05:30
082c2bcdd8 Add debug endpoint 2026-05-17 00:46:12 +05:30
7b6f033d42 Fix UUID join in auth.ts 2026-05-17 00:35:49 +05:30
57d1b070f4 Fix onboarding schema 2026-05-17 00:25:56 +05:30
92878a6bd9 Fix schema columns 2026-05-17 00:25:23 +05:30
e4b2019325 Fix family_members column 2026-05-17 00:18:49 +05:30
514b115326 Fix onboarding SQL column names
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-17 00:15:51 +05:30
e7a5de3cc2 Fix onboarding to use custom session auth
Was using next-auth which wasn't working with custom sessions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-17 00:13:56 +05:30
a54f30ddcb Security hardening - all 8 patches applied
Patch 1: Add requireFamily to chat route
Patch 2: Add requireFamily to family routes
Patch 3: Create admin-auth.ts, apply to all admin routes
Patch 4: Delete debug and migrate routes, update middleware
Patch 5: Create audit_log table and schema
Patch 6: Create password reset flow (reset-request, reset-confirm)
Patch 7: Replace with real HTTP security tests
Patch 8: RLS migrations already exist (01-app-role, 02-enable-rls)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 23:59:43 +05:30
b3e8b0a75f Fix TypeScript error in AI route 2026-05-16 23:13:24 +05:30
5acb2760cc Fix db imports: use dbUnscoped 2026-05-16 23:12:33 +05:30
2196c3d07d Security hardening: auth, bcrypt, rate-limiting, RLS, audit 2026-05-16 23:11:01 +05:30
4cf886ea43 Add security libs: auth, audit, rate-limit, scoped db 2026-05-16 23:10:56 +05:30
149d8bc72c auth: fix family_id join with uuid cast 2026-05-16 23:05:20 +05:30
0865706a94 Add WHO growth standards with percentile tracking
- Add head circumference to WHO standards (boys & girls 0-24 months)
- Update growth API to return WHO standards with records
- Update growth page to show percentile rankings
- Add head circumference input to form
- Use FamilyProvider instead of hardcoded childId
- Show percentile (e.g., "50th-85th") for each measurement

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 18:07:41 +05:30
b93f1f5dcf Add notifications API for vaccine reminders
- API endpoint /api/notifications returns due/overdue vaccines
- Checks child's birthDate to calculate due dates
- Returns notifications with type, status, days overdue

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 16:30:14 +05:30
39a93d64e2 Add GET /api/auth/signin for session checking
FamilyProvider calls GET /api/auth/signin to check if user is authenticated after page load.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:30:59 +05:30
3ffd3c32db Fix: Remove pediatrician_phone column reference
The column doesn't exist in production database, causing login failures.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:20:04 +05:30
c65051cf7d Add password management to admin users page
- Add PATCH endpoint to set user passwords
- Add password modal UI in admin panel
- Update CLAUDE.md with latest features

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:12:23 +05:30
752924a323 Add password status column to admin users page
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:03:58 +05:30
26af4b9318 Fix column name error in admin/families API
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 14:21:49 +05:30
2de47056e7 Fix admin panels
- Families: add "New Family" button
- Users: add "Add User" form with family selector
- Add delete user option
- Include member_id for proper removal

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 14:19:22 +05:30
da8675c045 Add admin member management
- View members per family
- Add new member by email
- Remove member from family
- Simple password auth migration file

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 10:45:38 +05:30
f967215fc8 Add email/password authentication
- Add password_hash to users table
- New login flow: email + password
- Sign up / Sign in toggle
- Simple password hashing (upgrade to bcrypt in prod)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 10:37:48 +05:30
09f263b423 Fix R2 photo privacy - filter by childId
- GET /api/upload now filters R2 listing by childId
- Only user's own photos are returned

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 09:31:09 +05:30
1c5c02ffbd Fix chat API query - use separate queries instead of aggregate
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 01:51:21 +05:30
9e506279a7 Fix AI chat performance and UX
- Single JOIN query instead of N+1 selects for sessions
- Auto-create session when sending without one
- Send button enabled when typing

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 01:49:36 +05:30
2d61ba2afc Fix chat API to work with database
- Use sql template literals instead of unsafe queries
- Handle UUID child_id requirement properly
- Fetch messages separately to avoid GROUP BY issues

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 01:40:40 +05:30
5aa7b7df31 Fix family_members API - use tagged template literals
- Remove display_name from query (column doesn't exist in DB)
- Use sql template literals instead of unsafe()
- Fix settings page to show member.name properly

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 00:53:02 +05:30
9e9ba17afb Fix family_members API - remove display_name column
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 00:51:48 +05:30
fdd2a67f7a Fix hardcoded IDs and data fetching across all pages
- Add signout button to menu (below Settings)
- Fix profile API to fetch user from database session
- Fix profile page to save name to database
- Fix settings page to use familyId from FamilyProvider
- Fix family page to use FamilyProvider
- Fix activity, ai, medical, memories pages to use FamilyProvider
- Remove all hardcoded "default" familyId and childId values

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 00:32:31 +05:30
a95f55967d Audit: Fix FamilyProvider, add signout, remove hardcoded defaults 2026-05-10 23:54:56 +05:30
35895d226f Auto-create user on signin 2026-05-10 23:48:23 +05:30
31d2c5a29f Fix signin SQL value handling 2026-05-10 23:43:38 +05:30
57e852bfbc Use database sessions with cookie instead of localStorage 2026-05-10 23:40:10 +05:30
1932d2ae6b Fix login flow to store and use real family_id 2026-05-10 23:37:54 +05:30
fbbc479032 Fix date handling in admin APIs 2026-05-10 23:12:56 +05:30
fe364c6e11 Fix admin API to use family_members table 2026-05-10 23:11:18 +05:30
43ee05d661 Fix TypeScript errors in revenue and support API 2026-05-10 22:47:38 +05:30
cda25b04ca Add comprehensive admin panel with analytics, families, users, children, revenue, support, settings 2026-05-10 22:43:20 +05:30
d5b07078ae Add Admin System
- Admin login at /admin/login
- Admin dashboard at /admin
- Username: admin, Password: admin123
- Separate from family email login

Family Login: /login (email-based)
Admin Login: /admin/login (username/password)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 22:17:21 +05:30
09dee5d987 Sprint 3: Admin Panel + Family Switching Complete
- FamilySwitcher component for multi-family support
- /api/family/members - GET members, PATCH role, DELETE remove
- /api/family - GET/PATCH family details
- Settings: Family Members list
- Settings: Family Settings (name, pediatrician phone, tier)
- Upgrade to Pro prompt in family settings

Full multi-family auth system now complete!

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 22:11:52 +05:30
f03484f262 Sprint 2: Invitation System Complete
- /api/invites - GET/POST invites
- /api/invites/accept - POST accept invite
- /invite/[token] - Accept invite page
- Settings page now has invite UI
- Checks member limit for free tier
- Shows upgrade prompt when limit reached

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 21:54:41 +05:30
c3255e82da Migrate Chat Sessions to database
- Add chat_sessions and chat_messages tables
- Create /api/chat endpoint for CRUD operations
- Update home page and /ai page to use database
- All chat history now persists across sessions and devices

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 21:13:21 +05:30
3e66b259f2 Migrate medical data from localStorage to database
- Add database tables: medicines, allergies, doctor_visits, illness_logs
- Create API endpoints: /api/medicines, /api/allergies, /api/visits, /api/illnesses
- Update medical page to use database APIs instead of localStorage
- All medical data now persists across sessions and devices

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 21:07:26 +05:30
967e00c4fa Add smart onboarding to Activity page
- Pediatric guidelines data with age-based schedules
- Show child's age and benchmarks on Activity page
- AI history generation via /api/history
- Generate button to auto-populate past logs from birth

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 16:12:23 +05:30