[jasrasr]

User goal

Make Workout Tracker useful on a phone while preserving existing live Hostinger workout data. Add authenticated workout details/photo viewing and a safe way to export records with private photos.

Features

• Details beside Edit in each workout history row. The mobile detail panel displays workout date/time, measurements, notes, tag, custom metrics, each weighted set, strength totals, edit history and the attached image.
• Protected photo endpoint ?photo=<24-char entry id>: central user-management authorization, per-user JsonStore lookup, exact saved photo reference, filename/path restriction, MIME and image validation, symlink rejection, no caching, and no client-supplied storage path.
• Download my workout backup: member-authenticated, CSRF-checked POST exports a ZIP containing that account's existing JSON records and edit history plus only referenced photos belonging to that account. Temporary archive is outside web root; missing/bad referenced photos prevent partial exports. ZIP extension detection disables the button when unsupported.
• Comprehensive backup/recovery runbook, including Hostinger pre-deployment backup, preservation checks and staged/manual recovery. No restore/delete endpoint.
• Bump to v1.5.0 and invalidate browser CSS/JS caches.

Live data protection

No live workout records were read or modified. No database migration or schema change. Existing user JSON, photos, record IDs, sessions, notes, timestamps and history remain untouched. Only application PHP/JS/CSS, tests and docs are in the branch. Existing edits remain locked and revision-checked.

Validation

• PHP tests using synthetic users and temporary images verify ownership, traversal and symlink denial, missing photo failure, unchanged JSON and complete ZIP contents (CI installs ZipArchive).
• JS DOM test verifies mobile detail rendering, rich workout fields, private photo ID URLs, legacy records and literal (not HTML) user notes.
• Existing parser, edit, measurement and mobile tests remain in CI.
• Manual checks still required on actual Hostinger/iPhone: original records/photos retained, signed-in image works, logged-out/second-user access denied, storage returns HTTP 403, no horizontal scroll, ZIP download opens and contains all expected personal records and images, webhook does not erase ignored storage.

Release and merge

GitHub Actions must pass. Use regular merge commit, not squash. Do not merge without explicit approval.

Follow-up: heart rate (BPM), added in v1.5.1

• Explicit no-key parsing of heart rate 143 bpm, HR 143, pulse 143, and 143 bpm within recognized workouts; avoids confusing 1 hr 15 minutes with BPM or interpreting at 145 bpm as a treadmill speed.
• Optional integer heart_rate_bpm (1–300) in manual entry, parsed review, edit, authenticated details, history summary, and exercise-specific trend charts. Treadmill/cardio display it by default; strength can use Show other measurements.
• Optional external AI response schema supports explicitly stated heart rate, with review required. No API key is needed for local parsing.
• Existing workout JSON and photo records remain unchanged; older clients omitting the new field cannot erase it. New synthetic tests cover validation, concurrent edit protection, retention of prior workouts and mobile field visibility.
• All GitHub Actions checks passed on the updated head. Hostinger/iPhone verification and storage backup remain required before production acceptance.

Attendance and weekday streaks (v1.6.0)

• Add four read-only attendance stats: last-seven and since-first-workout, each for all calendar days and Mon–Fri-only days.
• Deduplicate dates so multiple exercises count as one gym day. With Oct 21, 22, 27 on Tuesday Oct 27: 3/7 = 42.9%, 3/5 = 60.0% (not 66.7%). Current calendar and weekday streak: 1 day, longest: 2 days.
• Include current/longest calendar and weekday streaks (weekends skipped in weekday streaks; today remains unfinished), plus a compact seven-day strip.
• Uses existing JSON workout dates only, no storage changes, new API endpoints, or data migrations. Responsive 320px+ layout.
• New attendance / DOM regression tests cover first date, duplicate entries, rolling window, DST and weekend streaks. CI passed at head 67288d2f.