- Public display

CHANGELOG.md

@@ -14,6 +14,7 @@ All notable changes to Medical Tracker are documented here.
 - Added openFDA brand-name and substance-name buckets to the medicine source updater.
 - Added official medicine-use fields and source links populated from openFDA drug label `indications_and_usage` or `purpose` text.
 - Added computed `used_for` values to medicine API payloads so clients can display official label use text when available.
+- Added `config/public-access.json` toggles for disabling Admin and Tracker on public deployments.
 
 ### Changed
 
@@ -24,6 +25,7 @@ All notable changes to Medical Tracker are documented here.
 - Updated relationship generation so official medicine-use label text participates in condition and symptom linking.
 - Updated openFDA refreshes to fetch label documents first, then fall back to generic, brand, and substance buckets for broader coverage.
 - Renamed user-facing branding from "Neon Medical Tracker" to "Medical Tracker".
+- Updated public navigation, route guards, legacy signup redirect, and API write actions to honor the Admin/Tracker access toggles.
 - Batched imported medicine upserts inside a SQLite transaction for faster source refreshes.
 - Increased SQLite busy timeout for safer first-run migrations and source refreshes.
 - Updated `README.md` with current counts, relationship data, and source-refresh behavior.
@@ -85,7 +87,7 @@ All notable changes to Medical Tracker are documented here.
 - Removed the `public_signup` API action.
 - Removed signup links from the public header, footer, homepage, and condition pages.
 - Removed unused signup/showcase CSS from the public stylesheet.
-- Replaced `/signup.php` with a simple redirect to `/tracker.php` for legacy links.
+- Replaced `/signup.php` with a simple redirect for legacy links.
 
 ### Fixed
 
@@ -97,7 +99,7 @@ All notable changes to Medical Tracker are documented here.
 ### Verified
 
 - Verified dynamic medicine, symptom, condition, and terminology routes return `200` for representative records.
-- Verified legacy `/signup.php` returns `302` to `/tracker.php`.
+- Verified legacy `/signup.php` returns a `302` redirect.
 - Verified `api.php?action=public_signup` returns `404`.
 - Verified then-current SQLite snapshot counts: 6,002 medicines, 242 symptoms, 203 conditions, 23 terms, and 9 research-link categories.
 - Verified browser layout checks for medicine, symptom, and terminology pages at desktop and mobile widths with no horizontal overflow.

README.md

@@ -18,7 +18,7 @@ http://127.0.0.1:8080
 
 ## Public Routes
 
-- `/` - medical reference hub with search, database totals, and links to tracker/admin tools.
+- `/` - medical reference hub with search, database totals, and optional tracker/admin links when enabled.
 - `/nutrition.php` - searchable medicine catalog.
 - `/medicine.php?id=46` - dynamic medicine detail page backed by SQLite.
 - `/symptoms.php` - searchable symptom reference database.
@@ -28,9 +28,28 @@ http://127.0.0.1:8080
 - `/medical.php` - combined search for symptoms, terminology, conditions, medicines, and study links.
 - `/term.php?id=1` - dynamic medical terminology detail page backed by SQLite.
 - `/recovery.php` - NIH/NLM research and study-link categories.
-- `/tracker.php` - profile-scoped medical tracker dashboard.
+- `/tracker.php` - profile-scoped medical tracker dashboard when enabled.
-- `/admin.php` - admin user-management dashboard and medicine-source updater.
+- `/admin.php` - admin user-management dashboard and medicine-source updater when enabled.
-- `/signup.php` - legacy route that redirects to `/tracker.php`; public signup has been removed.
+- `/signup.php` - legacy route that redirects to `/tracker.php` when tracker is enabled, otherwise `/`; public signup has been removed.
+
+## Public Access Toggle
+
+Private profile tools are controlled by:
+
+```text
+config/public-access.json
+```
+
+The default public-safe configuration is:
+
+```json
+{
+  "admin_area_enabled": false,
+  "tracker_area_enabled": false
+}
+```
+
+When an area is disabled, its navigation links are hidden, direct page visits return a disabled public page, and related API write endpoints return `403`. Set either value to `true` to re-enable that area.
 
 ## Current Data
 
@@ -96,13 +115,15 @@ public/api.php
 
 Useful actions:
 
-- `GET api.php?action=state` - tracker/admin state payload.
+- `GET api.php?action=state` - tracker/admin state payload when at least one private area is enabled.
 - `GET api.php?action=library_search&q=chest&limit=20` - combined reference search.
 - `POST api.php?action=create_user` - create a user profile from admin/tracker tools.
 - `POST api.php?action=update_user` - update a user profile.
 - `POST api.php?action=delete_user` - delete a user profile.
 - `POST api.php?action=refresh_medication_sources` - refresh the medicine catalog from configured public sources.
 
+Private-area API actions return `403` when the matching Admin or Tracker toggle is disabled.
+
 The old `public_signup` action has been removed.
 
 ## Reference Sources
@@ -118,6 +139,6 @@ The old `public_signup` action has been removed.
 
 ## Notes
 
-- This project intentionally avoids a public signup funnel. Profiles are managed through `/admin.php` and `/tracker.php`.
+- This project intentionally avoids a public signup funnel. Profiles are managed through `/admin.php` and `/tracker.php` only when those private areas are enabled.
 - Dynamic detail pages use shared PHP endpoints and pull records from SQLite; individual medicine, symptom, condition, and term pages do not need to exist as separate files.
 - Legacy workout, nutrition, and supplement tracker data remains in the schema as wellness context, but the public app focus is now medical tracking and reference lookup.

app/bootstrap.php

@@ -4,9 +4,57 @@ declare(strict_types=1);
 date_default_timezone_set('America/New_York');
 
 const APP_ROOT = __DIR__ . '/..';
+const CONFIG_DIR = APP_ROOT . '/config';
+const PUBLIC_ACCESS_CONFIG_PATH = CONFIG_DIR . '/public-access.json';
 const DATA_DIR = APP_ROOT . '/data';
 const DB_PATH = DATA_DIR . '/health_tracker.sqlite';
 
+function public_access_config(): array
+{
+    static $config = null;
+
+    if (is_array($config)) {
+        return $config;
+    }
+
+    $config = [
+        'admin_area_enabled' => false,
+        'tracker_area_enabled' => false,
+    ];
+
+    if (!is_file(PUBLIC_ACCESS_CONFIG_PATH)) {
+        return $config;
+    }
+
+    $json = json_decode((string) file_get_contents(PUBLIC_ACCESS_CONFIG_PATH), true);
+    if (!is_array($json)) {
+        return $config;
+    }
+
+    foreach ($config as $key => $default) {
+        if (array_key_exists($key, $json)) {
+            $config[$key] = filter_var($json[$key], FILTER_VALIDATE_BOOLEAN);
+        }
+    }
+
+    return $config;
+}
+
+function app_admin_area_enabled(): bool
+{
+    return public_access_config()['admin_area_enabled'];
+}
+
+function app_tracker_area_enabled(): bool
+{
+    return public_access_config()['tracker_area_enabled'];
+}
+
+function app_private_tools_enabled(): bool
+{
+    return app_admin_area_enabled() || app_tracker_area_enabled();
+}
+
 function app_db(): PDO
 {
     static $pdo = null;
@@ -2698,7 +2746,7 @@ function state_payload(array $query): array
         }
     }
     $userId = (int) $currentUser['id'];
-    $currentUserIsAdmin = is_admin($pdo, $userId);
+    $currentUserIsAdmin = app_admin_area_enabled() && is_admin($pdo, $userId);
 
     $exercises = db_all(
         $pdo,

config/public-access.json

@@ -0,0 +1,4 @@
+{
+  "admin_area_enabled": false,
+  "tracker_area_enabled": false
+}

public/admin.php

@@ -2,6 +2,26 @@
 declare(strict_types=1);
 
 require __DIR__ . '/../app/bootstrap.php';
+
+if (!app_admin_area_enabled()) {
+    http_response_code(404);
+    $pageTitle = 'Admin Unavailable | Medical Tracker';
+    $activePage = '';
+    require __DIR__ . '/partials/site-header.php';
+    ?>
+    <main>
+        <section class="admin-public-shell record-shell">
+            <p class="site-eyebrow">Private area disabled</p>
+            <h1>Admin is not available.</h1>
+            <p>This public site is currently configured for reference browsing only.</p>
+            <a class="site-primary" href="/">Return home</a>
+        </section>
+    </main>
+    <?php
+    require __DIR__ . '/partials/site-footer.php';
+    exit;
+}
+
 app_db();
 
 $pageTitle = 'Admin Dashboard | Medical Tracker';
@@ -21,7 +41,9 @@ require __DIR__ . '/partials/site-header.php';
                 <span>Acting profile</span>
                 <select id="adminProfileSelect"></select>
             </label>
-            <a class="site-secondary" href="/tracker.php">Open tracker</a>
+            <?php if (app_tracker_area_enabled()): ?>
+                <a class="site-secondary" href="/tracker.php">Open tracker</a>
+            <?php endif; ?>
         </div>
 
         <div class="admin-denied" id="adminDenied" hidden>

public/api.php

@@ -8,6 +8,10 @@ try {
     $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
 
     if ($method === 'GET' && $action === 'state') {
+        if (!app_private_tools_enabled()) {
+            json_response(['error' => 'Private tracker/admin tools are disabled for this public site.'], 403);
+            exit;
+        }
         json_response(state_payload($_GET));
         exit;
     }
@@ -23,6 +27,31 @@ try {
     }
 
     $data = json_input();
+    $adminActions = [
+        'create_user' => true,
+        'update_user' => true,
+        'delete_user' => true,
+        'refresh_medication_sources' => true,
+    ];
+    $trackerActions = [
+        'update_theme' => true,
+        'create_exercise' => true,
+        'create_supplement' => true,
+        'create_nutrition_goal' => true,
+        'create_routine' => true,
+        'create_workout' => true,
+        'update_workout' => true,
+        'create_nutrition_log' => true,
+        'create_supplement_log' => true,
+        'create_body_metric' => true,
+        'create_medication_log' => true,
+        'create_vital_log' => true,
+        'create_lab_result' => true,
+        'create_symptom_log' => true,
+        'create_allergy_record' => true,
+        'create_appointment' => true,
+        'create_immunization_record' => true,
+    ];
     $routes = [
         'create_user' => 'create_user',
         'update_user' => 'update_user',
@@ -52,6 +81,16 @@ try {
         exit;
     }
 
+    if (isset($adminActions[$action]) && !app_admin_area_enabled()) {
+        json_response(['error' => 'Admin tools are disabled for this public site.'], 403);
+        exit;
+    }
+
+    if (isset($trackerActions[$action]) && !app_tracker_area_enabled()) {
+        json_response(['error' => 'Tracker tools are disabled for this public site.'], 403);
+        exit;
+    }
+
     json_response($routes[$action]($data));
 } catch (InvalidArgumentException $exception) {
     json_response(['error' => $exception->getMessage()], 400);

public/condition.php

@@ -52,7 +52,9 @@ require __DIR__ . '/partials/site-header.php';
                     <p><?= htmlspecialchars((string) $condition['overview'], ENT_QUOTES) ?></p>
                 </div>
                 <div class="record-actions">
-                    <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php if (app_tracker_area_enabled()): ?>
+                        <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php endif; ?>
                     <a class="site-secondary" href="/workouts.php?q=<?= rawurlencode((string) $condition['name']) ?>">Condition search</a>
                 </div>
             </div>

public/index.php

@@ -11,6 +11,8 @@ $totalTerms = (int) db_value($pdo, 'SELECT COUNT(*) FROM medical_terms');
 $totalSymptoms = (int) db_value($pdo, 'SELECT COUNT(*) FROM medical_symptoms');
 $totalConditions = (int) db_value($pdo, 'SELECT COUNT(*) FROM medical_conditions');
 $totalStudies = (int) db_value($pdo, 'SELECT COUNT(*) FROM research_studies');
+$trackerAreaEnabled = app_tracker_area_enabled();
+$adminAreaEnabled = app_admin_area_enabled();
 
 require __DIR__ . '/partials/site-header.php';
 ?>
@@ -19,7 +21,7 @@ require __DIR__ . '/partials/site-header.php';
         <div class="site-section-heading">
             <p class="site-eyebrow">Medical reference</p>
             <h1>Medicines, symptoms, terminology, conditions, and NIH/NLM study links.</h1>
-            <p>Search the reference database or open the tracker/admin tools for profile-managed medical logs.</p>
+            <p>Search the public reference database for medicine, condition, symptom, terminology, and research links.</p>
         </div>
 
         <form class="library-search" method="get" action="/medical.php">
@@ -78,31 +80,37 @@ require __DIR__ . '/partials/site-header.php';
         </div>
     </section>
 
-    <section class="admin-public-shell">
+    <?php if ($trackerAreaEnabled || $adminAreaEnabled): ?>
-        <div class="site-section-heading">
+        <section class="admin-public-shell">
-            <p class="site-eyebrow">Profile tools</p>
+            <div class="site-section-heading">
-            <h2>Manage medical logs through Tracker and Admin.</h2>
+                <p class="site-eyebrow">Profile tools</p>
-        </div>
+                <h2>Manage medical logs through enabled tools.</h2>
-        <div class="library-list">
+            </div>
-            <article class="library-row">
+            <div class="library-list">
-                <div class="library-row-main">
+                <?php if ($trackerAreaEnabled): ?>
-                    <h3>Tracker</h3>
+                    <article class="library-row">
-                    <p>Use existing profiles for medications, vitals, labs, symptoms, allergies, appointments, immunizations, and notes.</p>
+                        <div class="library-row-main">
-                </div>
+                            <h3>Tracker</h3>
-                <div class="library-row-actions">
+                            <p>Use existing profiles for medications, vitals, labs, symptoms, allergies, appointments, immunizations, and notes.</p>
-                    <a class="site-primary" href="/tracker.php">Open tracker</a>
+                        </div>
-                </div>
+                        <div class="library-row-actions">
-            </article>
+                            <a class="site-primary" href="/tracker.php">Open tracker</a>
-            <article class="library-row">
+                        </div>
-                <div class="library-row-main">
+                    </article>
-                    <h3>Admin</h3>
+                <?php endif; ?>
-                    <p>Create, update, activate, deactivate, and remove profiles from the admin dashboard.</p>
+                <?php if ($adminAreaEnabled): ?>
-                </div>
+                    <article class="library-row">
-                <div class="library-row-actions">
+                        <div class="library-row-main">
-                    <a class="site-secondary" href="/admin.php">Manage profiles</a>
+                            <h3>Admin</h3>
-                </div>
+                            <p>Create, update, activate, deactivate, and remove profiles from the admin dashboard.</p>
-            </article>
+                        </div>
-        </div>
+                        <div class="library-row-actions">
-    </section>
+                            <a class="site-secondary" href="/admin.php">Manage profiles</a>
+                        </div>
+                    </article>
+                <?php endif; ?>
+            </div>
+        </section>
+    <?php endif; ?>
 </main>
 <?php require __DIR__ . '/partials/site-footer.php'; ?>

public/medicine.php

@@ -54,7 +54,9 @@ require __DIR__ . '/partials/site-header.php';
                     <p><?= htmlspecialchars(medicine_used_for_text($medicine), ENT_QUOTES) ?></p>
                 </div>
                 <div class="record-actions">
-                    <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php if (app_tracker_area_enabled()): ?>
+                        <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php endif; ?>
                     <a class="site-secondary" href="/nutrition.php?q=<?= rawurlencode((string) $medicine['generic_name']) ?>">Catalog search</a>
                 </div>
             </div>

public/nutrition.php

@@ -26,7 +26,9 @@ require __DIR__ . '/partials/site-header.php';
             <p class="site-eyebrow">Medicine catalog</p>
             <h1>Search medicines by generic, chemical, brand, and alternate names.</h1>
             <p>The catalog includes common medicines and links each one to RxNorm, DailyMed, PubChem, MedlinePlus, PubMed, and ClinicalTrials.gov searches.</p>
-            <a class="site-primary" href="/tracker.php">Open medical tracker</a>
+            <?php if (app_tracker_area_enabled()): ?>
+                <a class="site-primary" href="/tracker.php">Open medical tracker</a>
+            <?php endif; ?>
         </div>
     </section>
 

public/partials/site-footer.php

@@ -3,10 +3,16 @@
             <strong>Medical Tracker</strong>
             <p>Medication logs, vitals, lab results, terminology, NIH/NLM study links, and admin-managed profiles.</p>
         </div>
-        <div class="footer-links">
+        <?php if (app_private_tools_enabled()): ?>
-            <a href="/tracker.php">Open medical tracker</a>
+            <div class="footer-links">
-            <a href="/admin.php">Admin dashboard</a>
+                <?php if (app_tracker_area_enabled()): ?>
-        </div>
+                    <a href="/tracker.php">Open medical tracker</a>
+                <?php endif; ?>
+                <?php if (app_admin_area_enabled()): ?>
+                    <a href="/admin.php">Admin dashboard</a>
+                <?php endif; ?>
+            </div>
+        <?php endif; ?>
     </footer>
 </body>
 </html>

public/partials/site-header.php

@@ -1,6 +1,8 @@
 <?php
 $pageTitle = $pageTitle ?? 'Medical Tracker';
 $activePage = $activePage ?? '';
+$trackerAreaEnabled = app_tracker_area_enabled();
+$adminAreaEnabled = app_admin_area_enabled();
 function site_active(string $page, string $activePage): string
 {
     return $page === $activePage ? ' class="active"' : '';
@@ -27,7 +29,11 @@ function site_active(string $page, string $activePage): string
             <a<?= site_active('symptoms', $activePage) ?> href="/symptoms.php">Symptoms</a>
             <a<?= site_active('research', $activePage) ?> href="/recovery.php">Research</a>
             <a<?= site_active('terminology', $activePage) ?> href="/medical.php">Terminology</a>
-            <a href="/tracker.php">Tracker</a>
+            <?php if ($trackerAreaEnabled): ?>
-            <a href="/admin.php">Admin</a>
+                <a href="/tracker.php">Tracker</a>
+            <?php endif; ?>
+            <?php if ($adminAreaEnabled): ?>
+                <a href="/admin.php">Admin</a>
+            <?php endif; ?>
         </nav>
     </header>

public/signup.php

@@ -1,5 +1,7 @@
 <?php
 declare(strict_types=1);
 
-header('Location: /tracker.php', true, 302);
+require __DIR__ . '/../app/bootstrap.php';
+
+header('Location: ' . (app_tracker_area_enabled() ? '/tracker.php' : '/'), true, 302);
 exit;

public/symptom.php

@@ -52,7 +52,9 @@ require __DIR__ . '/partials/site-header.php';
                     <p><?= htmlspecialchars((string) $symptom['plain_language_description'], ENT_QUOTES) ?></p>
                 </div>
                 <div class="record-actions">
-                    <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php if (app_tracker_area_enabled()): ?>
+                        <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php endif; ?>
                     <a class="site-secondary" href="/symptoms.php?q=<?= rawurlencode((string) $symptom['name']) ?>">Symptom search</a>
                 </div>
             </div>

public/term.php

@@ -41,7 +41,9 @@ require __DIR__ . '/partials/site-header.php';
                     <p><?= htmlspecialchars((string) $term['plain_language_definition'], ENT_QUOTES) ?></p>
                 </div>
                 <div class="record-actions">
-                    <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php if (app_tracker_area_enabled()): ?>
+                        <a class="site-primary" href="/tracker.php">Open tracker</a>
+                    <?php endif; ?>
                     <a class="site-secondary" href="/medical.php?q=<?= rawurlencode((string) $term['term']) ?>">Library search</a>
                 </div>
             </div>

public/tracker.php

@@ -2,6 +2,26 @@
 declare(strict_types=1);
 
 require __DIR__ . '/../app/bootstrap.php';
+
+if (!app_tracker_area_enabled()) {
+    http_response_code(404);
+    $pageTitle = 'Tracker Unavailable | Medical Tracker';
+    $activePage = '';
+    require __DIR__ . '/partials/site-header.php';
+    ?>
+    <main>
+        <section class="admin-public-shell record-shell">
+            <p class="site-eyebrow">Private area disabled</p>
+            <h1>Tracker is not available.</h1>
+            <p>This public site is currently configured for reference browsing only.</p>
+            <a class="site-primary" href="/">Return home</a>
+        </section>
+    </main>
+    <?php
+    require __DIR__ . '/partials/site-footer.php';
+    exit;
+}
+
 app_db();
 ?>
 <!doctype html>