pediatric-ai-scribe-v3/src/routes
Daniel 8dba73a615 feat(notes): read-mode default + Edit toggle + autosave + mobile layout
Four changes landing together so the UX flows properly.

1. Fix voice-generation model error.
   /api/notes/from-voice was passing `req.body.model` (undefined)
   through to callAI, which resolved to LITELLM_DEFAULT_MODEL (empty
   for LiteLLM deployments with no explicit default) → `model=""` →
   LiteLLM 400 "Invalid model name". Server now reads the admin-
   configured `models.default` setting, falls back to the
   LITELLM_DEFAULT_MODEL env var, and only passes a model if one
   resolved. Empty string never reaches the provider.

2. Read mode as the default post-save.
   Opening an existing note or saving a new one now lands on a
   clean, read-only rendering of the body (sanitized HTML with an
   allowlist — p/h2/h3/strong/em/u/s/a/ul/ol/li/blockquote/code/pre).
   Click the "Edit" button to switch to the Tiptap editor. Matches
   the mental model of "notes are documents I review, not drafts I'm
   always editing."

3. Autosave during edit.
   Title-input + Tiptap onUpdate trigger a 1.2-second-debounced save.
   In-flight saves coalesce: if the user types more while a save is
   in progress, a follow-up fires right after it lands so the last
   keystroke never gets stranded. beforeunload uses navigator.
   sendBeacon to best-effort flush on tab close. The manual Save
   button is kept as a "save + switch to reader" shortcut. Ctrl/
   Cmd+S still works in the editor.

4. Mobile layout.
   The two-pane layout collapses to a single-pane view below 900px,
   driven by a data-view attribute on .notes-layout. Back buttons
   appear in the reader + editor heads on mobile to return to the
   list. Desktop layout unchanged (sidebar + right pane always
   visible).

Also:
  • CSS specificity fix — .hidden{display:none} was losing to
    .notes-rec-indicator{display:inline-flex} on source order, so
    the "Recording" indicator was showing when idle. Added explicit
    .notes-rec-indicator.hidden + .notes-voice-bar .btn-sm.hidden
    overrides at higher specificity.
  • Reader-body sanitizer — allowlist of safe tags + attributes;
    <a> links get target=_blank + rel=noopener.
  • SW cache bumped to pedscribe-v12-notes2 so clients pick up the
    new module / component / CSS.
2026-04-24 12:45:30 +02:00
..
admin.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
adminConfig.js fix: auth/API logging to Loki, TTS voice auto-detection, STT ElevenLabs support 2026-04-19 21:26:49 +02:00
adminMilestones.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
audioBackups.js Security hardening: PHI encryption, argon2, DOMPurify, SRI 2026-04-14 02:49:38 +02:00
auth.js fix(security): timing-safe forgot-password + redact log file writer 2026-04-22 01:01:00 +02:00
billing.js Batch of security + scale fixes 2026-04-14 05:24:40 +02:00
chartReview.js Prompt-injection wrap: remaining AI routes 2026-04-14 05:31:54 +02:00
documents.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
encounters.js feat(security): AES-256-GCM at-rest encryption for encounters and memories 2026-04-22 01:01:00 +02:00
extensions.js feat(extensions): personal Pagers & Extensions directory with soft-delete 2026-04-22 18:54:26 +02:00
hospitalCourse.js Prompt-injection wrap: remaining AI routes 2026-04-14 05:31:54 +02:00
hpi.js Batch of security + scale fixes 2026-04-14 05:24:40 +02:00
learningAdmin.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
learningAI.js feat: neonatal calculator, DOCX/PPTX/ODT/EPUB support, gateway-agnostic URL helper, TTS/STT fixes 2026-04-19 02:17:06 +02:00
learningHub.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
logs.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
memories.js feat(security): AES-256-GCM at-rest encryption for encounters and memories 2026-04-22 01:01:00 +02:00
milestones.js Prompt-injection wrap: remaining AI routes 2026-04-14 05:31:54 +02:00
nextcloud.js Security hardening: PHI encryption, argon2, DOMPurify, SRI 2026-04-14 02:49:38 +02:00
notes.js feat(notes): read-mode default + Edit toggle + autosave + mobile layout 2026-04-24 12:45:30 +02:00
oidc.js Fix local-auth sections not showing for normal users + backup-code modal signature 2026-04-14 04:43:07 +02:00
peGuide.js fix(pe-guide): correct route imports (prod 500 regression) 2026-04-23 18:58:38 +02:00
refine.js Batch of security + scale fixes 2026-04-14 05:24:40 +02:00
sessions.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
sickVisit.js Prompt-injection wrap: remaining AI routes 2026-04-14 05:31:54 +02:00
soap.js Batch of security + scale fixes 2026-04-14 05:24:40 +02:00
transcribe.js fix: auth/API logging to Loki, TTS voice auto-detection, STT ElevenLabs support 2026-04-19 21:26:49 +02:00
tts.js fix: auth/API logging to Loki, TTS voice auto-detection, STT ElevenLabs support 2026-04-19 21:26:49 +02:00
userPreferences.js Stop leaking e.message to clients across all routes 2026-04-14 03:04:24 +02:00
wellVisit.js Prompt-injection wrap: remaining AI routes 2026-04-14 05:31:54 +02:00