Nutrio/AGENTS.md

# AGENTS.md

## Purpose

This file is a quick handover for future agents working on `D:\www\Nutrio`.
It describes what the project is, what is already implemented, and what still needs work.

## Project Summary

- Project name: `Nutrio`
- Goal: meal planning + nutrition tracking + daily diary totals.
- Backend: PHP (`tpsoft/apilite`, `tpsoft/dbmodel`)
- Frontend: Vue 3 + Vite + TypeScript
- Monorepo layout:
  - `backend/`
  - `frontend/`

## Current State (as of 2026-02-12)

- `README.md` already contains product specification in Slovak and English.
- Backend DB migrations exist in `backend/src/Maintenance.php` up to version `7`.
- Backend API methods are implemented in `backend/src/API.php`.
- Frontend is still template-level:
  - `frontend/src/App.vue` has placeholder content.
  - `frontend/src/router/index.ts` has empty `routes: []`.
- `backend/data.json` contains sample meal data (not currently wired into DB/API flow).

## Backend Architecture

- Entry point: `backend/public/API.php`
- Bootstrap and DB init: `backend/src/Init.php`
- Configuration: `backend/config/Configuration.php`
  - Supports `mysql` and `sqlite`
  - Loads override config files from `backend/config/*.php` (except the base file itself)
- Migration logic: `backend/src/Maintenance.php`
- API implementation: `backend/src/API.php`
- DB table models: `backend/src/Models/*.php`

## Database Schema Snapshot

Migration creates these tables:

- `options` (`key`, `value`) for internal settings, including DB version.
- `users` (`user_id`, `email`, `password_hash`, `created_at`).
- `ingredients`:
  - `ingredient_id`, `user_id`, `name`
  - per-100g values: `protein_g_100`, `carbs_g_100`, `sugar_g_100`, `fat_g_100`, `fiber_g_100`, `kcal_100`
- `meals`:
  - `meal_id`, `user_id`, `name`, `meal_type` (`breakfast|lunch|dinner`)
- `meal_items`:
  - `meal_item_id`, `meal_id`, `ingredient_id`, `grams`, `position`
- `diary_days`:
  - `diary_day_id`, `user_id`, `day_date`
  - unique: `(user_id, day_date)`
- `diary_entries`:
  - `diary_entry_id`, `diary_day_id`, `meal_type`, `meal_id`
  - unique: `(diary_day_id, meal_type)`

## API Surface (Implemented)

All actions are invoked through `backend/public/API.php` with `?action=<method_name>`.

- Utility:
  - `health`
- Ingredients:
  - `ingredientList(user_id, query = "", include_global = true)`
  - `ingredientGet(user_id, ingredient_id)`
  - `ingredientCreate(user_id, name, protein_g_100, carbs_g_100, sugar_g_100, fat_g_100, fiber_g_100 = 0, kcal_100 = 0)`
  - `ingredientUpdate(user_id, ingredient_id, name, protein_g_100, carbs_g_100, sugar_g_100, fat_g_100, fiber_g_100 = 0, kcal_100 = 0)`
  - `ingredientDelete(user_id, ingredient_id)`
- Meals:
  - `mealList(user_id, meal_type = "", with_items = false, with_totals = false)`
  - `mealGet(user_id, meal_id, with_items = true, with_totals = true)`
  - `mealCreate(user_id, name, meal_type)`
  - `mealUpdate(user_id, meal_id, name, meal_type)`
  - `mealDelete(user_id, meal_id)`
- Meal items:
  - `mealItemList(user_id, meal_id, with_calculated = true)`
  - `mealItemAdd(user_id, meal_id, ingredient_id, grams, position = 1)`
  - `mealItemUpdate(user_id, meal_item_id, ingredient_id, grams, position)`
  - `mealItemDelete(user_id, meal_item_id)`
  - `mealItemReorder(user_id, meal_id, ordered_item_ids)`
- Calculations:
  - `mealTotals(user_id, meal_id)`
- Diary:
  - `diaryDayGet(user_id, day_date, with_totals = true)`
  - `diaryDaySetMeal(user_id, day_date, meal_type, meal_id)`
  - `diaryDayUnsetMeal(user_id, day_date, meal_type)`
  - `diaryRange(user_id, date_from, date_to)`

## Behavior and Validation Rules

- `meal_type` must be one of: `breakfast`, `lunch`, `dinner`.
- Date params must use format `YYYY-MM-DD`.
- `grams` must be `> 0`.
- Nutrition input values are validated as non-negative.
- If `kcal_100` is `0`, API computes kcal by formula:
  - `protein*4 + carbs*4 + fat*9`
- Ownership checks are enforced by `user_id`:
  - meals and meal items must belong to the user
  - ingredients can be user-owned or global (`user_id = null`) for read/select
- API currently requires an existing `users` record for almost all actions.

## Known Pitfalls and Notes

- The historical FK issue in `meal_items` should reference `meals(meal_id)`.  
  Current file already uses the correct FK.
- If someone ran migrations before FK fix, old MySQL state may still be broken.  
  In that case reset affected table(s) or rebuild DB from clean state.
- Some comments in `Maintenance.php` show encoding artifacts, but SQL structure is valid.
- Authentication is not implemented yet; `user_id` is passed as an action parameter.
- For `array` parameters (for example `ordered_item_ids`), APIlite expects JSON in request payload.
- APIlite wraps responses with a nested `data` object. Keep this in mind on frontend parsing.

## Local Runbook

Backend:

- `cd backend`
- `composer install`
- configure DB via `backend/config/*.php` override
- serve `backend/public` through web server/PHP runtime
- first API hit triggers `Maintenance->database()` migration flow

Frontend:

- `cd frontend`
- `npm install`
- `npm run dev`
- optional checks: `npm run type-check`, `npm run build`, `npm run lint`

## Product Behavior Target (what to build next)

- Implement auth and session handling (replace plain `user_id` input model).
- Build frontend screens for ingredients, meals, meal item editor, diary day, diary range.
- Connect frontend to implemented backend actions.
- Add API tests for validation, ownership checks, and totals calculation consistency.
- Add pagination/filter strategy where list endpoints grow.

## Practical Conventions

- Keep IDs as `BIGINT UNSIGNED` and use `*_id` naming consistently.
- Keep MySQL + SQLite compatibility in SQL where possible (project supports both).
- When changing schema, always bump DB version in `Maintenance.php` with forward-only migration steps.
- Keep API action names stable unless frontend is updated at the same time.