tom/HealthLog

0 Fork 0

mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 12:32:43 +00:00

Files

T

Marc-André Bombeck 2c88acc5f7 fix(labs): serve the in-browser OCR engine from this origin

Local lab OCR reads a report photo on the device with tesseract.js, whose
defaults load the worker, the WebAssembly core and the language data
from cdn.jsdelivr.net. The production CSP allows workers and fetches only
from this origin, so the engine could not load; where it did load (dev),
the browser of anyone scanning a report contacted a third-party CDN.

The worker, the three LSTM core builds and the deu and eng best_int
language data (about 17 MB) are now copied from pinned packages into
public/tesseract/ at prebuild and predev, and createWorker is pointed at
them with the worker started from its URL rather than a blob. A test
holds the options against the staged file list.

2026-09-26 15:37:13 +02:00

__tests__

feat(config): let the operator turn off the breach and update checks

2026-09-26 15:33:34 +02:00

app

feat(config): let the operator turn off the breach and update checks

2026-09-26 15:33:34 +02:00

cli

…

components

feat(config): let the operator turn off the breach and update checks

2026-09-26 15:33:34 +02:00

hooks

fix(body-sites): skip the site suggestions read without the visits section

2026-09-25 22:08:30 +02:00

lib

fix(labs): serve the in-browser OCR engine from this origin

2026-09-26 15:37:13 +02:00

types

refactor(admin): read the off-host card from evidence, sort the worst row first

2026-09-10 10:32:33 +02:00

instrumentation.ts

fix(release): harden v1.31 arrival contracts

2026-07-20 00:40:20 +02:00

proxy.ts

fix(mcp): let the consent screen return to the connecting client

2026-09-15 14:06:27 +02:00

README.md

…

README.md

`src/`

Application source. HealthLog is a Next.js 16 App Router project (output: "standalone", React 19, TypeScript strict). The path alias @/* resolves to this directory. Everything a request touches lives under here; the layout below follows the request flow rather than alphabetical order.

Request flow

client → src/proxy.ts → src/app/<route>/route.ts → src/lib/api-handler.ts → handler body → src/lib/api-response.ts → client

proxy.ts — the HTTP edge (Next.js 16's renamed middleware). Public-path allowlist, demo-mode mutation block, server-side onboarding redirect, worker-only refusal, x-request-id + CSP nonce generation, every security header.
app/ — App Router pages (RSC by default) and API routes. Every API route wraps its handler in apiHandler. See app/README.md.
lib/ — the server/runtime toolkit: apiHandler, auth, crypto, rollups, AI, notifications, pg-boss jobs, integrations, rate limiting. See lib/README.md.
components/ — React components (shadcn/ui new-york, kebab-case files). See components/README.md.

Other directories

hooks/ — shared React hooks (use- prefix, kebab-case).
types/ — shared TypeScript declarations.
generated/prisma/ — the generated Prisma client (do not edit; regenerated by prisma generate). Imported as @/generated/prisma.
instrumentation.ts — Next.js startup hook; boots the pg-boss worker registry and boot-time backfill queues.
__tests__/ — cross-cutting unit tests; most tests live in __tests__/ folders next to the code they cover.

Conventions

See ../CLAUDE.md for the full set. The load-bearing ones: RSC by default ("use client" only when a hook/state/browser API needs it); every API route wraps apiHandler and parses its body with Zod safeParse; userId is always narrowed from session or Bearer, never accepted as a body field; TanStack Query keys come only from src/lib/query-keys/; outbound HTTP goes through src/lib/safe-fetch.ts.