- Added detailed security risk table with examples for SQL injection, XSS, secrets exposure, CSRF, and insecure deserialization
- Included NestJS/Prisma/Next.js-specific detection patterns and PowerShell scripts for automated scanning
- Added tool integration instructions for npm audit and eslint-plugin-security
- Expanded security analysis to focus on framework-specific vulnerabilities rather than generic risks
- Removed outdated documentation files (MVP_CHECKLISTA.md, NEXT_STEPS.md, README.md, TEKNISK_BESKRIVNING.md, filanalys.md, flyerimporter.md, kilo.json, plan-dokumentation.md)
- Added new centralized documentation structure under docs/ directory
- Added .kilo/ directory for Kilo AI agent configuration and plans
BREAKING CHANGE: Legacy documentation files removed and replaced with new centralized structure
- Simplified conditional logic for displayNameDetailed assignment
- Added fallback to preserve existing value when displayNameDetailed is falsy
- Reformatted multi-line object initialization for better readability
- Added `originCountries` field to `InventoryItem` model for multi-country origin support
- Updated `CreateInventoryDto` and `UpdateInventoryDto` with `originCountries` array field
- Modified `InventoryService` to handle `originCountries` in create and update operations
- Added `origin` field to `FlyerImportItem` response type for consistency
- Added `categoryId` field to `ParsedReceiptItem` DTO for improved receipt parsing
- Created database migration `20260524_add_origin_countries` for schema changes
- Added `productName` field to `AdminAiWarning` to include product context in warnings
- Updated `collectWarnings` to extract and include `rawName` as `productName` in AI trace warnings
- Added `signals` field to `FlyerParseItem` type for detailed product signals
- Enhanced Flutter admin panel to display product names in AI trace warnings
- Added new `AdminAiTraceResponse` DTO for AI trace data structure
- Added --env-file .env to all docker compose commands for consistent environment variable loading
- Added MISTRAL_API_KEY validation in deploy.sh with fatal error if missing
- Added --force-recreate flag to recipe-api restarts in disable/enable receipt trace scripts
- Added .env file existence check in rebuild_flutter.sh
- Added API service recreation logic in deploy.sh when backend/importer services are updated
- Updated jest ecosystem to v30.x in backend/package.json
- Added controlled overrides for test-exclude to remove inflight@1.0.6 and glob@7.2.3
- Updated README.md with deprecation handling procedures and debugging steps
- Modified .kilo/plans/1779643125894-lucky-island.md to document systematic approach for dependency management
- Added `min-release-age=1` to backend/.npmrc to require packages to be at least 1 day old
- GitHub Actions backend jobs already use `npm ci` in backend/ directory, automatically enforcing the policy
- Updated README.md with supply-chain protection policy and operational procedures
BREAKING CHANGE: npm install/npm ci will now fail for packages younger than 1 day unless policy is temporarily overridden
- Added `signals` and `displayNameDetailed` fields to FlyerItem model in Prisma schema
- Introduced `FlyerImportSignals` type with origin countries, labels, quality flags, variant, and packaging
- Added `displayNameDetailed` field to FlyerImportItem DTO and Flutter model
- Implemented utility functions for signal extraction and display name building
- Updated flyer import service to persist and return signals/category data
- Enhanced Flutter UI to display detailed product information including badges for signals
- Added new test coverage for signals persistence and display name generation
- Added new import-common module for shared import utilities
- Created database migration for new fields
- Added Kilo plan for feature development
- Added structured warning system with `AdminAiWarning` type in backend and Flutter
- Implemented detailed reason descriptors with `FlyerReasonDescriptor` for parse and match operations
- Added `legacyWarnings` field to maintain backward compatibility
- Enhanced AI trace service to collect and format warnings with item-level context
- Updated flyer import services to include detailed reason descriptions in responses
- Added Swedish diacritic preservation for cheese variants (Prästost, Herrgårdsost, Grevéost)
- Implemented UTF-8 content validation for AI responses
- Added new reason code definitions in `reason-codes.ts`
- Updated Flutter UI to display structured warnings with severity indicators
- Added error report generation and copy functionality in admin panel
- Added comprehensive test coverage for new warning system and cheese normalization
BREAKING CHANGE: AI trace warnings are now structured objects instead of simple strings
Updated the Content-Security-Policy header to include Google Fonts and Google Analytics domains:
- Added `https://www.gstatic.com` to `script-src`, `script-src-elem`, `img-src`, and `font-src` directives
- Removed duplicate `script-src` and `style-src` entries in the policy
- Ensured all relevant directives properly include the new domains
- Add source maps and web renderer build arguments with defaults
- Configure Caddy with CSP headers, cache policies, and service worker handling
- Defer loading of import screen for performance optimization
- Add semantic labels to icons for accessibility
- Update web index.html with Swedish language, meta tags, and description
- Add robots.txt and lighthouse configuration
- Add new planning documents and archive entries
- Add DELETE /users/me endpoint with cascading data removal
- Implement frontend confirmation dialog and deletion flow
- Add audit logging for deletion requests
- Update localization files for new UI strings
- Add scheduled cleanup service for AI traces
- Document GDPR compliance in technical specification
BREAKING CHANGE: Users can now permanently delete their profiles and associated data
- Replace outdated security and data protection section with current requirements
- Add new checklist items for authentication migration to httpOnly cookies
- Include AI trace retention policy and penetration testing requirements
- Update target audience and document status to 2026-05-21
- Add E2E testing requirements for flyer and receipt imports
- Document GDPR compliance processes
- Update NEXT_STEPS.md with completed AI trace persistence and admin panel enhancements
- Add new section for executed steps (2026-05-21) documenting AI trace integration
- Update README.md with new AI trace features and improvements
- Enhance TEKNISK_BESKRIVNING.md with detailed technical description of AI trace implementation
- Document backend flow, persistence, masking, and UI improvements
- Add next steps including retention policy and API filtering for AiTrace
- Add FlyerTraceSupplement type for AI trace metadata
- Implement getFlyerTraceSupplements method to fetch trace supplements
- Update AiTraceService to include prompt/rawOutput and counters in flyer traces
- Add persistFlyerTrace method to FlyerImportService for trace persistence
- Enhance AiFlyerParserService to return structured trace data with prompts and retries
- Update FlyerNormalizerService with OCR typo fixes for cheese variants and spröd bakad firre
- Improve Flutter admin panel with selectable text, warnings display, and tooltips
- Add comprehensive tests for AI trace supplements and normalization rules
- Add AiTrace model to Prisma schema with relations to User
- Implement AiTraceService with CRUD operations for AI traces
- Add new admin panel for AI traces with filtering and detail views
- Integrate trace persistence in receipt import flow
- Add API endpoints for listing and retrieving AI traces
- Update Flutter admin UI with new AI tab and navigation
- Add new domain models for AI traces and details
- Add migration for AiTrace table creation
BREAKING CHANGE: None
- Set Jest timeout to 15 seconds for products.update-category.http.spec.ts
- Ensures reliable execution of category update integration tests
BREAKING CHANGE: None
- Add logic to split Swedish cheese variants (Präst, Herrgård, Grevé) into separate products
- Implement brand normalization for "Arla Ko" and category assignment to "Hårdost"
- Update flyer parser with detailed rules for bundle/group announcements
- Add unit tests for variant splitting and brand/category normalization
- Replace single-item return with flatMap for expanded product lists
- Replace references to removed `--migrate` flag with new migration behavior
- Document automatic migration execution during `--clean-database` deployments
- Add details about Prisma Client generation output visibility in deploy logs
- Correct maintenance SQL file usage and table references
- Remove deprecated --migrate flag and related RUN_MIGRATE logic
- Simplify database cleanup workflow to always run migrations before cleaning
- Add run_prisma_generate() function to update Prisma Client after migrations
- Update documentation to reflect new workflow where --clean-database implies migration
- Remove conditional migration logic that could cause double execution
- Add SKIP_MIGRATION environment variable to control automatic Prisma migrations in backend
- Update Dockerfile to conditionally run migrations based on SKIP_MIGRATION flag
- Enhance deploy.sh with:
- Better error handling using set -euo pipefail
- New --skip-migration flag to bypass automatic migration startup
- Improved documentation and help text
- New helper functions for waiting on services and database
- Better status reporting for migration results
- Update compose.yml to include SKIP_MIGRATION environment variable
- Add bundle support with isBundle, bundleWeight, and bundleItems fields
- Add brand, weight, and comparisonUnit fields to FlyerItem model
- Update AI flyer parser to extract bundle information
- Add sanitization for bundle items in FlyerNormalizerService
- Update DTOs and interfaces to include new fields
- Add migration for new database fields
- Update tests to cover bundle item handling
Updated three documentation files to reflect recent deployment and maintenance improvements:
- NEXT_STEPS.md: Added completed steps for 2026-05-20 including deploy script updates, Prisma integration, standardized database cleaning, and production fixes
- README.md: Added new deployment flags and maintenance file information for 2026-05-20 release
- TEKNISK_BESKRIVNING.md: Added technical details about new deploy flow, database cleaning process, and production hotfix resolution
Added two new documentation files:
- .kilo/plans/1779256422838-glowing-knight.md: Contains development plan for the "Glowing Knight" feature
- plan-dokumentation.md: Provides overview of project planning structure and documentation standards
Added new deployment options to deploy.sh:
- --migrate: Runs Prisma migration deploy command
- --clean-database: Executes maintenance SQL to clean data while preserving categories
Added new maintenance directory backend/prisma/maintenance/ containing:
- clean-database.sql: SQL script for database cleaning operations
Updated deployment script to:
- Include new command-line flags in help text
- Add conditional blocks for running migrations and database cleaning
- Implement container readiness checks before running Prisma commands
- Preserve existing seed functionality while adding new maintenance features
This commit introduces a comprehensive shopping list feature with the following key changes:
Backend:
- Added ShoppingListItem model with relations to User, Product, and Category
- Added new fields to FlyerSession for source file metadata
- Added categoryId field to FlyerItem model
- Implemented session source file retrieval endpoint
- Added endpoint for updating flyer session items with category assignment
- Added endpoint for planning flyer selections to shopping list
- Implemented backfillCategoriesMine for AI-assisted category assignment
- Added ShoppingListModule and integrated with FlyerSelectionModule
Frontend:
- Added ShoppingListScreen and navigation route
- Implemented API paths and client methods for shopping list operations
- Added category tree loading for shopping list item creation
- Integrated shopping list functionality in flyer import tab
- Added category backfill trigger in inventory screen
- Updated FlyerImportItem model with categoryId support
- Added methods for updating flyer session items and retrieving source files
Database:
- Added new Prisma migration for flyer source metadata and shopping list items
- Updated schema with new relations and indexes
The shopping list feature allows users to:
1. Plan flyer selections directly to their shopping list
2. View and manage their shopping list items
3. Update flyer session items with proper categorization
4. Retrieve original flyer source files
5. Automatically backfill categories for uncategorized products
- Add new API endpoints for retrieving flyer import sessions:
- GET /flyer-import/sessions/latest - Retrieve latest session for user
- GET /flyer-import/sessions/:sessionId - Retrieve specific session
- Implement session persistence and restoration in Flutter UI
- Add toJson() methods to FlyerImportItem and FlyerImportResult for serialization
- Add new FlyerImportSession domain model for local session management
- Add unit test file for FlyerImportService
- Update FlyerImportController with new endpoints and user ID extraction
- Update FlyerImportService with session retrieval logic and response mapping
- Update API paths in Flutter client
- Add session restoration on widget init in FlyerImportTab
- Replace fixed text window retry strategy with dynamic chunk-based approach
- Add configurable chunk size, overlap, and maximum chunks via environment variables
- Implement chunk splitting with overlap handling for context preservation
- Add chunk processing with retry logic per chunk
- Include deduplication of items across chunks
- Update logging to reflect chunk-based processing
BREAKING CHANGE: Changes the retry strategy from fixed text windows to dynamic chunk-based processing. Existing configurations may need adjustment for FLYER_AI_CHUNK_SIZE_CHARS, FLYER_AI_CHUNK_OVERLAP_CHARS, and FLYER_AI_MAX_CHUNKS.
- Add FLYER_AI_TIMEOUT_MS and FLYER_AI_RETRIES environment variables
- Configure timeout and retry settings in compose.yml
- Update AiFlyerParserService with configurable timeout and retry logic
- Add text window reduction strategy for retry attempts
- Update documentation in TEKNISK_BESKRIVNING.md
- Fix ESLint configuration in app.security.spec.ts
- Add support for PNG, JPEG, and WebP image formats in flyer import
- Replace external importer service with internal AI-based parsing pipeline
- Add new services: TextExtractorService, AiFlyerParserService, FlyerNormalizerService
- Integrate Mistral AI, pdf-parse, and tesseract.js dependencies
- Add quality confidence indicators and warning panels in Flutter UI
- Update package.json with new dependencies and transform ignore patterns
- Add documentation for flyer importer system
- Add Kilo AI planning file for Happy Island project
BREAKING CHANGE: Flyer import now uses internal AI parsing instead of external importer service
- Remove outdated Willys flyer PDF (0001-0008_WIL_V21_ED1pdf.pdf)
- Add new Willys flyer PDF (willys_reklamblad.pdf)
- Improve offer detection logic in backend flyer-import service
- Add offer limit text extraction and sanitization in Flutter UI
- Fix Swedish character encoding issues in UI text
Update project documentation with recent CI improvements and flyer import enhancements:
- Add ESLint configuration for backend and Dart lints for Flutter
- Document Prisma query logging via PRISMA_LOG_QUERIES environment variable
- Update NEXT_STEPS.md, README.md, and TEKNISK_BESKRIVNING.md with new features
- Add isOffer, offerLimitText, comparisonPrice, comparisonUnit, parseConfidence, and parseReasons fields to FlyerImportItem
- Update FlyerImportResponse type to include new fields
- Extend file picker to support image formats (png, jpg, jpeg, webp)
- Add offer badge display and price formatting in Flutter UI
- Implement PDF preview functionality for flyer import
Add documentation for enabling Prisma query logging in test environments via PRISMA_LOG_QUERIES environment variable.
Include:
- Step-by-step instructions for configuration in Docker Compose
- Environment setup requirements
- Performance and security considerations
- Warning against production use
- Add ESLint configuration for backend TypeScript code
- Include linting step in backend quality checks
- Add linting step to GitHub Actions CI workflow
- Enable configurable Prisma query logging via PRISMA_LOG_QUERIES environment variable
- Update PrismaService to support dynamic log levels based on PRISMA_LOG_QUERIES
- Replace BadRequestException with UnauthorizedException in receipt import security tests
- Replace BadRequestException with UnauthorizedException for authentication failures in flyer-import and flyer-selection controllers
- Add bulk selection endpoint in FlyerSelectionController for creating multiple selections in one request
- Update FlyerSelectionModule to include new FlyerSelectionMatcherService and FlyerSelectionSyncController
- Extend FlyerSelectionService with createMany method for bulk operations
- Add new DTOs for bulk selection and receipt matching functionality
- Update ReceiptImportService to accept FlyerSelectionService dependency and track successful rows
- Extend SaveReceiptResponse with flyerAutoSync field for receipt-to-flyer matching results
- Add new API paths for flyer import and selection endpoints
- Update Flutter UI to include Flyer import tab and adjust tab controller length
- Add new domain models and repository methods for flyer import functionality
- Update test files to include new FlyerSelectionService dependency
- Modify .kilo plan documentation to reflect current system architecture
- Add FlyerSession, FlyerItem, and FlyerSelection models to Prisma schema
- Implement session persistence with weekly key generation in FlyerImportService
- Add FlyerSelectionModule to AppModule
- Extend FlyerImportResponse with sessionId and flyerItemId fields
- Create new flyer-selection module directory structure
- Add migration for flyer session and selection tables
BREAKING CHANGE: Flyer import now persists data to FlyerSession and FlyerItem tables
Nils-Johan Gynther
nilsjohan