chore: sync from nutritrace-dev (v1.0.0-rc.39)

Author: thebigjoe1

.env.example

@@ -39,16 +39,22 @@ JWT_SECRET=change-me-to-a-long-random-secret
 # INSECURE_COOKIES=1
 
 # ─── Local Open Food Facts mirror (Issue #22) ──────────────────────────────
-# When OFF_LOCAL_DB is set, barcode and food-name lookups try a local DuckDB
+# When OFF_LOCAL_DB is set, barcode and food-name lookups try a local OFF
 # mirror before reaching the public api.openfoodfacts.org. Useful for
 # air-gapped self-hosters, strict-egress environments, and resilience when
 # the OFF API is down.
 #
+# File formats supported (auto-detected by extension):
+#   .parquet  — Hugging Face Parquet dump (default since rc.39, the
+#               maintained option after OFF retired their native DuckDB
+#               snapshot). DuckDB queries it via read_parquet().
+#   .duckdb   — Legacy native DuckDB file (pre-rc.39 setups still work).
+#
 # Setup:
 #   1. Uncomment the OFF mirror volume mount in docker-compose.yml
-#   2. Set OFF_LOCAL_DB below to the in-container path (default /data/off.duckdb).
-#      NutriTrace downloads the initial snapshot (~4 GB) automatically on first
-#      boot if the file is missing — no manual wget required.
+#   2. Set OFF_LOCAL_DB below to the in-container path (default /data/off.parquet).
+#      NutriTrace downloads the initial snapshot (~7-8 GB) automatically on
+#      first boot if the file is missing — no manual wget required.
 #   3. (Optional) Set OFF_LOCAL_ONLY=1 to refuse any fallback to the remote
 #      OFF API. True air-gap mode: lookups for products not in the mirror
 #      return "not found" instead of querying the public API.
@@ -60,10 +66,12 @@ JWT_SECRET=change-me-to-a-long-random-secret
 # atomic swap; no container restart needed. See DEPLOY.md → "Local Open Food
 # Facts mirror" for the full guide.
 #
-# OFF_LOCAL_DB=/data/off.duckdb
+# OFF_LOCAL_DB=/data/off.parquet
 # OFF_LOCAL_ONLY=1
-# Optional — pin the download source. Defaults to the official OFF nightly build.
-# OFF_LOCAL_URL=https://challenges.openfoodfacts.org/products.duckdb
+# Optional — pin the download source. Defaults to the maintained Hugging Face
+# Parquet dump. To use a legacy / self-hosted DuckDB file instead, set this to
+# a URL ending in .duckdb and use a .duckdb extension on OFF_LOCAL_DB.
+# OFF_LOCAL_URL=https://huggingface.co/datasets/openfoodfacts/product-database/resolve/main/food.parquet?download=true
 
 # Optional — Log level (error | warn | info | debug)
 # Default: info — logs requests, warnings, and errors

.gitignore

@@ -34,14 +34,3 @@ data/
 *.swp
 *.swo
 
-# Android — build artifacts and generated files (keep source, ignore generated)
-android/.gradle/
-android/app/build/
-android/build/
-android/local.properties
-android/capacitor-cordova-android-plugins/
-android/.idea/
-*.apk
-*.aab
-*.keystore
-android/keystore.properties

CHANGELOG.md

@@ -9,6 +9,42 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ---
 
+## [1.0.0-rc.39] — 2026-05-27
+
+### Added
+
+- **OIDC RP-initiated logout (PWA + Android).** Signing out now also ends the
+  session at your identity provider, so the next sign-in isn't silently
+  completed by a still-alive IdP session. Requires registering two Post Logout
+  Redirect URIs at your IdP (HTTPS root for PWA, `nutritrace://oidc-callback`
+  for Android). Thanks to @jimmielightner. (Issue #48, PR #49)
+- **Edit any Quick Calories entry.** Tap a Quick Calories row in the diary to
+  change the kcal, name, or any of the three optional macros.
+
+### Changed
+
+- **OFF local mirror now uses the Hugging Face Parquet snapshot** since OFF
+  retired the previous DuckDB source. Existing setups keep working without
+  renaming; format is auto-detected. (Issue #22 followup)
+- **Quick Calories diary row uses your custom name** when a meal has just one
+  Quick Calories entry. Multi-entry meals still collapse to "Quick Calories × N".
+- **Diary edit sheet macro pills get the four-color treatment** (yellow / purple
+  / green / orange) to match the Quick Calories card and Foods quantity sheet.
+- **Number-input spinner arrows removed app-wide** across food, meal, recipe,
+  and diary edits.
+
+### Fixed
+
+- **Docker image now actually loads DuckDB.** Base swapped from Alpine to
+  Debian-slim so the OFF mirror feature works end to end. Image grows ~30 MB.
+  (Reported by @duplaja)
+- **Goals: body-stat fallback now appears on the initial "Your Goals" tab**
+  instead of only after switching tabs. (Issue #46 followup from @duplaja)
+- **Quick Calories: macro input width grows with the typed value** so the "g"
+  stays flush against the digits regardless of length.
+
+---
+
 ## [1.0.0-rc.38] — 2026-05-25
 
 ### Added

DEPLOY.md

@@ -145,23 +145,25 @@ Self-hosters on air-gapped networks, in strict-egress environments, or just want
 
 1. Uncomment the OFF mirror volume mount in `docker-compose.yml`:
    ```yaml
-   - ${OFF_LOCAL_DB_HOST_PATH:-./off.duckdb}:/data/off.duckdb
+   - ${OFF_LOCAL_DB_HOST_PATH:-./off.parquet}:/data/off.parquet
    ```
    Note: the mount is read-write so NutriTrace can perform in-place refresh via atomic swap. Earlier docs suggested `:ro`; if you previously set that, change it to writable so scheduled and manual refreshes work.
 
 2. Set the env vars in `.env`:
    ```bash
-   OFF_LOCAL_DB_HOST_PATH=/path/on/host/off.duckdb   # the host path (will be created if missing)
-   OFF_LOCAL_DB=/data/off.duckdb                     # the in-container path
-   # Optional — pin the download URL (defaults to the official OFF nightly build).
-   # OFF_LOCAL_URL=https://challenges.openfoodfacts.org/products.duckdb
+   OFF_LOCAL_DB_HOST_PATH=/path/on/host/off.parquet   # the host path (will be created if missing)
+   OFF_LOCAL_DB=/data/off.parquet                     # the in-container path
+   # Optional — pin the download URL (defaults to the maintained Hugging Face Parquet dump).
+   # OFF_LOCAL_URL=https://huggingface.co/datasets/openfoodfacts/product-database/resolve/main/food.parquet?download=true
    # Optional — full air-gap mode (never call api.openfoodfacts.org)
    # OFF_LOCAL_ONLY=1
    ```
 
+   Note on file formats: since rc.39, NutriTrace defaults to the OFF Parquet dump on Hugging Face (~7-8 GB) because OFF retired their pre-built native DuckDB snapshot. The lookup code transparently opens the Parquet via DuckDB's `read_parquet()` so per-barcode queries are still fast (DuckDB row-group prunes). If you still have a legacy `.duckdb` file at `OFF_LOCAL_DB`, that path is auto-detected by file extension and continues to work unchanged.
+
 3. `docker compose up -d` to recreate the container.
 
-4. **NutriTrace handles the initial download automatically.** On startup, if `OFF_LOCAL_DB` is set and the file is missing, it pulls the full snapshot (~4 GB) from `OFF_LOCAL_URL` in the background. Lookups during the initial pull fall through to the public OFF API (or, in air-gap mode, return "not found") until the download completes. Watch the container logs for `[off-local] refresh complete` to confirm readiness, or open Settings → Connected Services → Open Food Facts; the banner shows live download progress.
+4. **NutriTrace handles the initial download automatically.** On startup, if `OFF_LOCAL_DB` is set and the file is missing, it pulls the full snapshot (~7-8 GB) from `OFF_LOCAL_URL` in the background. Lookups during the initial pull fall through to the public OFF API (or, in air-gap mode, return "not found") until the download completes. Watch the container logs for `[off-local] refresh complete` to confirm readiness, or open Settings → Connected Services → Open Food Facts; the banner shows live download progress.
 
 ### Refreshing the mirror
 
@@ -174,8 +176,8 @@ You can also click **Refresh Now** in the same panel to force an immediate refre
 Prefer the command line? You can still drop a fresh file in place manually:
 
 ```bash
-wget https://challenges.openfoodfacts.org/products.duckdb -O /path/on/host/off.duckdb.new
-mv /path/on/host/off.duckdb.new /path/on/host/off.duckdb
+wget 'https://huggingface.co/datasets/openfoodfacts/product-database/resolve/main/food.parquet?download=true' -O /path/on/host/off.parquet.new
+mv /path/on/host/off.parquet.new /path/on/host/off.parquet
 # Optional — trigger reopen without waiting for the next lookup:
 docker compose restart
 ```
@@ -198,7 +200,7 @@ The native Android client normally calls `api.openfoodfacts.org` directly (bypas
 
 The mirror file is **deliberately excluded from NutriTrace's full-backup ZIPs**. It's a ~4 GB reproducible snapshot of public OFF data; bundling it would balloon backups for no real benefit. Backups continue to contain only your SQLite database (foods, meals, diary, settings, etc.) and your uploaded photos. Your chosen Auto-Refresh interval is preserved (it's a tiny `app_config` row), so after restoring on a fresh install the schedule comes back automatically; the next refresh cycle (or a manual Refresh Now) re-populates the mirror file itself.
 
-If you want a mirror snapshot in your own off-site storage, copy the `off.duckdb` host file directly with whatever tool you already use (rsync, restic, borg, etc.) — separate from NutriTrace's backup flow.
+If you want a mirror snapshot in your own off-site storage, copy the `off.parquet` (or legacy `off.duckdb`) host file directly with whatever tool you already use (rsync, restic, borg, etc.) — separate from NutriTrace's backup flow.
 
 ### Caveats
 

Dockerfile

@@ -11,8 +11,16 @@ COPY . .
 RUN npm run build
 
 # ── Stage 2: Express server + static frontend ────────────────────────────────
-FROM node:20-alpine
-RUN apk add --no-cache python3 make g++
+# Debian-slim base (not Alpine) — the @duckdb/node-bindings-linux-x64 native
+# library used by the OFF mirror feature is glibc-linked and won't load on
+# musl-based images. On Alpine, DuckDB fails with "Error loading shared
+# library ld-linux-x86-64.so.2: No such file or directory" because the
+# glibc dynamic linker isn't present. DuckDB does not ship a musl variant
+# of those node bindings, so a glibc base is required.
+FROM node:20-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends python3 build-essential \
+ && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY server/package*.json ./
 RUN npm install --omit=dev

README.md

@@ -413,6 +413,13 @@ Optional. Connect any OpenID Connect 1.0 compliant identity provider — **Authe
 
 **Mobile**: Android in server-connected mode supports SSO too. The app opens the IdP authorize URL in an in-app browser (Chrome Custom Tabs); the IdP redirects back via `nutritrace://oidc-callback/` deep link, the app intercepts it and signs you in — no manual paste, no token wrangling.
 
+**Logout (RP-initiated)**: when an SSO user signs out, NutriTrace also ends the session at the IdP via the standard OIDC end-session endpoint (using `id_token_hint`), so the next sign-in isn't silently completed by a still-alive IdP session. For this to work, register **two Post Logout Redirect URIs** at your IdP:
+
+   - `https://your-nutritrace-host/` (or your `BASE_URL` root) for PWA logouts.
+   - `nutritrace://oidc-callback` for Android logouts.
+
+If the IdP doesn't expose an `end_session_endpoint` (some don't), logout falls back to a local-only clear and the next login prompts again only if the IdP's own session has expired.
+
 **Security**: client secrets are encrypted at rest using the same key derivation as wearable OAuth tokens. Email-based auto-linking only fires when the IdP explicitly flags the email verified, AND the provider's `auto-register` is enabled — both gates have to be on, since email-based auto-link is the main account-takeover vector if the IdP is dishonest about verification.
 
 ---

android/app/build.gradle

@@ -19,8 +19,8 @@ android {
         applicationId "com.nutritrace.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 107
-        versionName "1.0.0-rc.38"
+        versionCode 108
+        versionName "1.0.0-rc.39"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

docker-compose.yml

@@ -9,12 +9,14 @@ services:
       - ${DATA_UPLOADS_PATH}:/data/uploads
       # Optional — local Open Food Facts mirror (for air-gapped or
       # offline-resilient barcode + name lookups). Uncomment the mount + set
-      # OFF_LOCAL_DB in .env. NutriTrace downloads the initial ~4 GB snapshot
-      # automatically on first boot if the file is missing; subsequent
-      # refreshes happen on a schedule from the Settings UI. Mount is
-      # read-write so atomic swap during refresh succeeds.
-      # See DEPLOY.md → "Local Open Food Facts mirror" for the full recipe.
-      # - ${OFF_LOCAL_DB_HOST_PATH:-./off.duckdb}:/data/off.duckdb
+      # OFF_LOCAL_DB in .env. NutriTrace downloads the initial ~7-8 GB
+      # Parquet snapshot from Hugging Face automatically on first boot if
+      # the file is missing; subsequent refreshes happen on a schedule from
+      # the Settings UI. Mount is read-write so atomic swap during refresh
+      # succeeds. File extension is auto-detected — Parquet (default) or
+      # legacy .duckdb both supported. See DEPLOY.md → "Local Open Food
+      # Facts mirror" for the full recipe.
+      # - ${OFF_LOCAL_DB_HOST_PATH:-./off.parquet}:/data/off.parquet
     # Forward every variable from .env into the container. Without this, only
     # variables explicitly named in the `environment:` block below reach the
     # app, so .env settings like INSECURE_COOKIES were silently ignored (#41).
@@ -77,12 +79,14 @@ services:
       # Env-defined providers show with a lock badge in Settings → Authentication
       # and are read-only there — edit via .env / docker-compose / k8s secrets.
       # Optional — Local Open Food Facts mirror (Issue #22). When set,
-      # barcode + name lookups try the local DuckDB before reaching out
+      # barcode + name lookups try the local mirror before reaching out
       # to api.openfoodfacts.org. Path is the in-container path matching
-      # the volume mount above. See DEPLOY.md for download / refresh.
-      # - OFF_LOCAL_DB=${OFF_LOCAL_DB:-}                        # e.g. /data/off.duckdb
+      # the volume mount above. File extension is auto-detected — Parquet
+      # (default since rc.39) or legacy .duckdb both supported. See
+      # DEPLOY.md for download / refresh.
+      # - OFF_LOCAL_DB=${OFF_LOCAL_DB:-}                        # e.g. /data/off.parquet
       # - OFF_LOCAL_ONLY=${OFF_LOCAL_ONLY:-}                    # 1 = air-gap mode, never call remote OFF
-      # - OFF_LOCAL_URL=${OFF_LOCAL_URL:-}                      # override download source (defaults to OFF nightly build)
+      # - OFF_LOCAL_URL=${OFF_LOCAL_URL:-}                      # override download source (defaults to HF Parquet)
       # Any server env var may also be supplied via <NAME>_FILE, for example:
       # - SMTP_PASS_FILE=/run/secrets/nutritrace_smtp_pass
       # - AI_API_KEY_FILE=/run/secrets/nutritrace_ai_api_key

package.json

@@ -1,18 +1,12 @@
 {
   "name": "nutritrace",
-  "version": "1.0.0-rc.38",
+  "version": "1.0.0-rc.39",
   "private": true,
   "type": "module",
   "scripts": {
     "dev": "vite",
     "build": "vite build",
     "preview": "vite preview",
-    "android": "npm run build && npx cap sync android && npx cap open android",
-    "android:build": "npm run build && npx cap sync android",
-    "android:run": "npx cap run android",
-    "cap:sync": "npm run build && npx cap sync",
-    "cap:add:android": "npx cap add android",
-    "i18n:check": "node scripts/i18n-check.cjs",
     "postinstall": "node scripts/postinstall.cjs"
   },
   "dependencies": {