Marc-André Bombeck
eb1779d5c1
Default documentDate at store time. A store-only upload no longer lands with a NULL filing date: when the client omits one, default it to the upload day so the column is always set on a stored row. The library list sorts, groups, and range-filters on the same effective date the UI shows, so undated uploads no longer mis-sort under nulls-last, break date-group headers, or fall through the range filter. The date stays user-editable and may be cleared back to NULL via PATCH. Block re-extraction once any fact is APPROVED. A partially-confirmed document stays EXTRACTED, which the CONFIRMED guard does not catch; re-extracting would delete the approved facts (severing the committed record's provenance) and re-stage them as PENDING, letting a second approval duplicate the committed lab / condition / medication. The extract route now refuses with 409 (documents.inbound.alreadyPartlyConfirmed) when approved facts exist; the user must finish reviewing or discard first. RFC 5987-encode the original-download filename. The Content-Disposition now carries both an ASCII filename= fallback and a filename*=UTF-8'' value so a non-ASCII name survives intact; the stored set is inline-safe by construction, so the dead attachment branch is removed. Add a light per-user rate-limit backstop to the original-read, PATCH, and DELETE routes (generous; self-DoS only — the routes are owner-scoped). Lean the list counts: tally facts for the whole page in one grouped count instead of materialising fact-id rows, and exclude REJECTED facts from factCount. Extend the documentDate index with deleted_at to cover the list scan. Document the deliberate plaintext-title PHI tradeoff at the column and the store site.
src/app/
The Next.js App Router tree: the page surfaces a logged-in user sees and the REST API under api/. Server components are the default; "use client" is added only where a hook, state, or browser API needs it. Routing is file-based — a page.tsx is a page, a route.ts is an API endpoint.
API routes (api/)
Every endpoint wraps its handler in apiHandler (@/lib/api-handler), parses any body with Zod safeParse, narrows userId from the session or Bearer token (never from the body), and returns the { data, error, meta? } envelope. requireAdmin() is cookie-only, so api/admin/ is unreachable by Bearer token. Notable groups:
auth/— login, register, password, passkey (WebAuthn), refresh, Codex device-OAuth.measurements/,mood-entries/,medications/,sleep/— the core health-data CRUD + batch/bulk ingest.ingest/— external Bearer-token ingest surfaces.insights/,analytics/,dashboard/— AI insights, the Coach SSE stream, trend summaries, the first-paint dashboard snapshot.withings/,whoop/,fitbit/,integrations/,sync/— OAuth connect/sync/webhook surfaces and the offline delta feed.fhir/,share-links/,doctor-report/,export/,import/— clinician-facing FHIR R4 read API, shareable records, report + data export.notifications/,devices/,send/,telegram/— channel registration, device tokens, dispatch, webhook intake.admin/— operator panel APIs (cookie-only).health/,version/,meta/,internal/— health check, build-version probe, runtime metadata, worker-internal routes.
Page surfaces
measurements/, medications/, mood/, insights/, achievements/, notifications/, settings/, onboarding/, admin/, plus the public about/, privacy/, bugreport/, the share-record route c/, and the root dashboard (page.tsx). Shared shell + chrome lives in layout.tsx; error.tsx / global-error.tsx / not-found.tsx / loading.tsx cover the framework boundaries. layout.tsx holds the one nonce-bound dangerouslySetInnerHTML (theme bootstrap).
Conventions
See ../../CLAUDE.md. The request-flow walk in .planning/codebase/arch.md annotates each layer with file:line citations. Related dirs: handlers compose ../lib/; pages render ../components/.