Commit graph

97 commits

Author SHA1 Message Date
2196c3d07d Security hardening: auth, bcrypt, rate-limiting, RLS, audit 2026-05-16 23:11:01 +05:30
4cf886ea43 Add security libs: auth, audit, rate-limit, scoped db 2026-05-16 23:10:56 +05:30
149d8bc72c auth: fix family_id join with uuid cast 2026-05-16 23:05:20 +05:30
0865706a94 Add WHO growth standards with percentile tracking
- Add head circumference to WHO standards (boys & girls 0-24 months)
- Update growth API to return WHO standards with records
- Update growth page to show percentile rankings
- Add head circumference input to form
- Use FamilyProvider instead of hardcoded childId
- Show percentile (e.g., "50th-85th") for each measurement

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 18:07:41 +05:30
b93f1f5dcf Add notifications API for vaccine reminders
- API endpoint /api/notifications returns due/overdue vaccines
- Checks child's birthDate to calculate due dates
- Returns notifications with type, status, days overdue

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 16:30:14 +05:30
39a93d64e2 Add GET /api/auth/signin for session checking
FamilyProvider calls GET /api/auth/signin to check if user is authenticated after page load.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:30:59 +05:30
3ffd3c32db Fix: Remove pediatrician_phone column reference
The column doesn't exist in production database, causing login failures.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:20:04 +05:30
c65051cf7d Add password management to admin users page
- Add PATCH endpoint to set user passwords
- Add password modal UI in admin panel
- Update CLAUDE.md with latest features

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:12:23 +05:30
752924a323 Add password status column to admin users page
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 15:03:58 +05:30
26af4b9318 Fix column name error in admin/families API
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 14:21:49 +05:30
2de47056e7 Fix admin panels
- Families: add "New Family" button
- Users: add "Add User" form with family selector
- Add delete user option
- Include member_id for proper removal

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 14:19:22 +05:30
da8675c045 Add admin member management
- View members per family
- Add new member by email
- Remove member from family
- Simple password auth migration file

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 10:45:38 +05:30
f967215fc8 Add email/password authentication
- Add password_hash to users table
- New login flow: email + password
- Sign up / Sign in toggle
- Simple password hashing (upgrade to bcrypt in prod)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 10:37:48 +05:30
09f263b423 Fix R2 photo privacy - filter by childId
- GET /api/upload now filters R2 listing by childId
- Only user's own photos are returned

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 09:31:09 +05:30
1c5c02ffbd Fix chat API query - use separate queries instead of aggregate
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 01:51:21 +05:30
9e506279a7 Fix AI chat performance and UX
- Single JOIN query instead of N+1 selects for sessions
- Auto-create session when sending without one
- Send button enabled when typing

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 01:49:36 +05:30
2d61ba2afc Fix chat API to work with database
- Use sql template literals instead of unsafe queries
- Handle UUID child_id requirement properly
- Fetch messages separately to avoid GROUP BY issues

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 01:40:40 +05:30
5aa7b7df31 Fix family_members API - use tagged template literals
- Remove display_name from query (column doesn't exist in DB)
- Use sql template literals instead of unsafe()
- Fix settings page to show member.name properly

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 00:53:02 +05:30
9e9ba17afb Fix family_members API - remove display_name column
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 00:51:48 +05:30
fdd2a67f7a Fix hardcoded IDs and data fetching across all pages
- Add signout button to menu (below Settings)
- Fix profile API to fetch user from database session
- Fix profile page to save name to database
- Fix settings page to use familyId from FamilyProvider
- Fix family page to use FamilyProvider
- Fix activity, ai, medical, memories pages to use FamilyProvider
- Remove all hardcoded "default" familyId and childId values

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 00:32:31 +05:30
a95f55967d Audit: Fix FamilyProvider, add signout, remove hardcoded defaults 2026-05-10 23:54:56 +05:30
35895d226f Auto-create user on signin 2026-05-10 23:48:23 +05:30
31d2c5a29f Fix signin SQL value handling 2026-05-10 23:43:38 +05:30
57e852bfbc Use database sessions with cookie instead of localStorage 2026-05-10 23:40:10 +05:30
1932d2ae6b Fix login flow to store and use real family_id 2026-05-10 23:37:54 +05:30
fbbc479032 Fix date handling in admin APIs 2026-05-10 23:12:56 +05:30
fe364c6e11 Fix admin API to use family_members table 2026-05-10 23:11:18 +05:30
43ee05d661 Fix TypeScript errors in revenue and support API 2026-05-10 22:47:38 +05:30
cda25b04ca Add comprehensive admin panel with analytics, families, users, children, revenue, support, settings 2026-05-10 22:43:20 +05:30
d5b07078ae Add Admin System
- Admin login at /admin/login
- Admin dashboard at /admin
- Username: admin, Password: admin123
- Separate from family email login

Family Login: /login (email-based)
Admin Login: /admin/login (username/password)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 22:17:21 +05:30
09dee5d987 Sprint 3: Admin Panel + Family Switching Complete
- FamilySwitcher component for multi-family support
- /api/family/members - GET members, PATCH role, DELETE remove
- /api/family - GET/PATCH family details
- Settings: Family Members list
- Settings: Family Settings (name, pediatrician phone, tier)
- Upgrade to Pro prompt in family settings

Full multi-family auth system now complete!

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 22:11:52 +05:30
f03484f262 Sprint 2: Invitation System Complete
- /api/invites - GET/POST invites
- /api/invites/accept - POST accept invite
- /invite/[token] - Accept invite page
- Settings page now has invite UI
- Checks member limit for free tier
- Shows upgrade prompt when limit reached

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 21:54:41 +05:30
c3255e82da Migrate Chat Sessions to database
- Add chat_sessions and chat_messages tables
- Create /api/chat endpoint for CRUD operations
- Update home page and /ai page to use database
- All chat history now persists across sessions and devices

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 21:13:21 +05:30
3e66b259f2 Migrate medical data from localStorage to database
- Add database tables: medicines, allergies, doctor_visits, illness_logs
- Create API endpoints: /api/medicines, /api/allergies, /api/visits, /api/illnesses
- Update medical page to use database APIs instead of localStorage
- All medical data now persists across sessions and devices

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 21:07:26 +05:30
967e00c4fa Add smart onboarding to Activity page
- Pediatric guidelines data with age-based schedules
- Show child's age and benchmarks on Activity page
- AI history generation via /api/history
- Generate button to auto-populate past logs from birth

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 16:12:23 +05:30
83314e91a8 Update Family, Profile with working APIs - fetch & save baby details 2026-05-10 15:52:59 +05:30
6a6a0e91da Fix: check R2 config at runtime not build time 2026-05-10 15:30:15 +05:30
c58f64552d Use env vars for R2 (remove hardcoded creds) 2026-05-10 15:18:49 +05:30
cc239ec574 Fix public URL format 2026-05-10 15:10:09 +05:30
e5b57ee7bc Fix endpoint: remove /tia path 2026-05-10 15:08:40 +05:30
cf5ea7b820 Working upload, list has issues 2026-05-10 15:02:47 +05:30
1dd8563450 Debug: list buckets first 2026-05-10 15:01:53 +05:30
d2c7cee1e8 Final fix for upload API 2026-05-10 14:48:22 +05:30
1fc52a0609 Clean upload API with proper types 2026-05-10 14:46:49 +05:30
4bac63e065 Fix endpoint: add /tia suffix 2026-05-10 14:45:29 +05:30
59ae046726 Simplify: just list bucket contents for debug 2026-05-10 14:44:30 +05:30
d4f617e159 Use account-level endpoint 2026-05-10 14:43:35 +05:30
7b4f47667b Use hardcoded R2 credentials (for testing only) 2026-05-10 14:42:50 +05:30
73c3ddb53e Debug: list all bucket objects 2026-05-10 14:42:03 +05:30
bdd2d3967b Clean up upload API 2026-05-10 14:41:18 +05:30