dewemoji/legacy-system-audit.md

Legacy System Audit (Retraced)

Scope used for this audit

• ../dewemoji-api (backend)
• ../dewemoji-chrome-ext (chrome extension)
• ../dewemoji-site (website)

1) Current reality by folder

A) dewemoji-api (backend, currently functional)

• Contains working API routes and working web pages (index.html, api-docs.html).
• API files:
  • api/index.php
  • api/emojis.php
  • api/emoji.php
• Helpers:
  • helpers/auth.php
  • helpers/filters.php
• Data pipeline:
  • tools/build-emojis.js
  • data in data/*.json
• Apache rewrite and security rules in .htaccess.

B) dewemoji-chrome-ext (active extension)

• Manifest V3 extension with side panel UI.
• Main files:
  • manifest.json
  • panel.js, panel.html, styles.css
  • background.js, content.js
• Uses remote API https://api.dewemoji.com/v1.

C) dewemoji-site (website repo, currently scaffold)

• Folder exists with expected site structure (index.php, api-docs.php, assets/, data/, helpers/, etc.).
• Almost all files are currently empty (0 bytes).
• Current state indicates scaffold/template placeholder, not active website logic.

2) Dataset snapshot (from dewemoji-api)

• Source: ../dewemoji-api/data/emojis.json
• Emojis: 1910
• Categories: 10 (Activities, Animals & Nature, Component, Flags, Food & Drink, Objects, People & Body, Smileys & Emotion, Symbols, Travel & Places)
• Subcategories: 99

3) Feature inventory

Backend/API (implemented in dewemoji-api)

• Public read API with pagination/filtering.
• GET /api/emojis
• GET /api/emoji/{slug}
• GET /api/categories
• CORS enabled for GET/OPTIONS.
• IP rate limit in router (60 requests / 60 seconds).
• ETag and cache headers.

Chrome extension (implemented in dewemoji-chrome-ext)

• Search, category/subcategory filters.
• Free/Pro mode UX.
• License activation check flow.
• Copy / insert / auto mode.
• Skin tone preference + lock.
• Side panel and keyboard toggle command.
• Client cache + daily free usage tracking.

Website (dewemoji-site)

• Not implemented yet (empty files).
• Current working website behavior still lives in dewemoji-api HTML/JS pages.

4) Important mismatches and risks

1. Query param mismatch in backend list endpoint:

• api/emojis.php reads query.
• Docs/client examples often send q.

2. Backend license validators are stubs:

• isValidGumroad() and isValidMayar() return false.
• Tier in this PHP backend effectively falls back to free.

3. Contract split:

• Backend folder exposes /api/*.
• Extension expects /v1/* on api.dewemoji.com.

4. Website source-of-truth gap:

• dewemoji-site is currently empty scaffold, so active website behavior is still in dewemoji-api.

5) Folder health snapshot

• dewemoji-api: 20 files, 20 non-empty (~4.3 MB)
• dewemoji-chrome-ext: 13 files, 13 non-empty (~135 KB)
• dewemoji-site: 40 files, 1 non-empty (.gitignore), rest empty scaffold