# Legacy System Audit (Retraced)

## Scope used for this audit

- `../dewemoji-api` (backend)
- `../dewemoji-chrome-ext` (chrome extension)
- `../dewemoji-site` (website)

## 1) Current reality by folder

### A) `dewemoji-api` (backend, currently functional)
- Contains working API routes and working web pages (`index.html`, `api-docs.html`).
- API files:
  - `api/index.php`
  - `api/emojis.php`
  - `api/emoji.php`
- Helpers:
  - `helpers/auth.php`
  - `helpers/filters.php`
- Data pipeline:
  - `tools/build-emojis.js`
  - data in `data/*.json`
- Apache rewrite and security rules in `.htaccess`.

### B) `dewemoji-chrome-ext` (active extension)
- Manifest V3 extension with side panel UI.
- Main files:
  - `manifest.json`
  - `panel.js`, `panel.html`, `styles.css`
  - `background.js`, `content.js`
- Uses remote API `https://api.dewemoji.com/v1`.

### C) `dewemoji-site` (website repo, currently scaffold)
- Folder exists with expected site structure (`index.php`, `api-docs.php`, `assets/`, `data/`, `helpers/`, etc.).
- Almost all files are currently **empty (0 bytes)**.
- Current state indicates scaffold/template placeholder, not active website logic.

## 2) Dataset snapshot (from `dewemoji-api`)

- Source: `../dewemoji-api/data/emojis.json`
- Emojis: **1910**
- Categories: **10** (`Activities`, `Animals & Nature`, `Component`, `Flags`, `Food & Drink`, `Objects`, `People & Body`, `Smileys & Emotion`, `Symbols`, `Travel & Places`)
- Subcategories: **99**

## 3) Feature inventory

### Backend/API (implemented in `dewemoji-api`)
- Public read API with pagination/filtering.
- `GET /api/emojis`
- `GET /api/emoji/{slug}`
- `GET /api/categories`
- CORS enabled for GET/OPTIONS.
- IP rate limit in router (60 requests / 60 seconds).
- ETag and cache headers.

### Chrome extension (implemented in `dewemoji-chrome-ext`)
- Search, category/subcategory filters.
- Free/Pro mode UX.
- License activation check flow.
- Copy / insert / auto mode.
- Skin tone preference + lock.
- Side panel and keyboard toggle command.
- Client cache + daily free usage tracking.

### Website (`dewemoji-site`)
- Not implemented yet (empty files).
- Current working website behavior still lives in `dewemoji-api` HTML/JS pages.

## 4) Important mismatches and risks

1. Query param mismatch in backend list endpoint:
- `api/emojis.php` reads `query`.
- Docs/client examples often send `q`.

2. Backend license validators are stubs:
- `isValidGumroad()` and `isValidMayar()` return `false`.
- Tier in this PHP backend effectively falls back to free.

3. Contract split:
- Backend folder exposes `/api/*`.
- Extension expects `/v1/*` on `api.dewemoji.com`.

4. Website source-of-truth gap:
- `dewemoji-site` is currently empty scaffold, so active website behavior is still in `dewemoji-api`.

## 5) Folder health snapshot

- `dewemoji-api`: 20 files, 20 non-empty (~4.3 MB)
- `dewemoji-chrome-ext`: 13 files, 13 non-empty (~135 KB)
- `dewemoji-site`: 40 files, 1 non-empty (`.gitignore`), rest empty scaffold