ÖRZA web
ÖRZA is an India-first AI wellness platform. People snap meals, chat or voice-log in English, Hindi or Hinglish, get nutrition insights, set goals, get recipes and gentle "rebalance" plans after special meals, and read daily and weekly reports. The Care module adds medicines with photos, alarms created from a scanned prescription, reminders (Web Push, WhatsApp, an in-app alarm), a calendar feed, and health data sync.
SPEC.md is the shared build contract. It covers the architecture, design system and every API route.
Stack
Next.js 15 (App Router, TypeScript, src/) · React 19 · Tailwind 3.4 · framer-motion · lucide-react · sonner · zod · jose (JWT) · bcryptjs · MongoDB · web-push · fflate.
Getting started
npm install
cp .env.example .env.local # then fill in the values (see below)
npm run dev # http://localhost:3100
With no MONGODB_URI, data goes to .data/orza-db.json. That file store is for local development only. With no OPENAI_API_KEY, meal text logging, chat, recipes and rebalance plans use ÖRZA's built-in Indian food database and rule-based coach instead. Photo scanning (meals and prescriptions) needs a key.
| Command | What |
|---|
npm run dev | Dev server on port 3100 |
npm run build / npm start | Production build / server (port 3100) |
npm run typecheck | tsc --noEmit |
node scripts/make-admin.mjs <email> | Grant admin access to an existing account as a sub-admin (--super, --sub, --revoke, --list) |
Configuration
Every variable is documented in .env.example. For production:
MONGODB_URI, MONGODB_DB: required. Indexes are created on first connect.JWT_SECRET: required, 32 or more random characters. It signs session tokens (the website's cookie and the phone app's Bearer token). Sessions are also recorded server-side, so signing out revokes them.NEXT_PUBLIC_SITE_URL: the public https:// origin. Canonical links, Open Graph URLs, calendar feed links and notification links are built from it. If it is unset, page metadata uses the Vercel deployment host on Vercel. On any other host it falls back to http://localhost:3100 and logs a warning.OPENAI_API_KEY, plus optional OPENAI_MODEL and OPENAI_VISION_MODEL (both default to gpt-4o-mini). Reasoning models such as the o-series and gpt-5 work too, and OPENAI_REASONING_EFFORT tunes them. The vision model must accept images: it never falls back to the text model.- Reminders:
VAPID_PUBLIC_KEY, NEXT_PUBLIC_VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY and VAPID_SUBJECT are for Web Push (npx web-push generate-vapid-keys). CRON_SECRET protects /api/cron/dispatch. The WhatsApp Cloud API variables are optional.
Admin console and roles
Admin accounts are staff-only. Signing in with one opens the admin console at /dashboard/admin. The console has its own sidebar with Overview, Members, Credit requests, Team and My account. It never shows the member app: no Today page, meals, Care, onboarding or credits pill. If an admin opens a member page, they are sent back to the console. Member numbers and lists leave admin accounts out.
There are two roles:
| Role | Can |
|---|
Super admin (admin_role: "super") | Everything below, plus the Team page: add sub-admins, reset a sub-admin's password, remove a sub-admin |
Sub-admin (admin_role: "sub", or no role) | Overview stats, Members (search, adjust credits), Credit requests, My account (change password, sign out) |
Adding a sub-admin. On Team, choose Add sub-admin and enter a name and work email. You can let ÖRZA generate a strong 14-character password or set one yourself. This creates a new, separate staff account; the email must not already belong to an ÖRZA account. The password is shown once. Share it privately and ask the sub-admin to change it under My account after they first sign in. Reset password gives the sub-admin a new one-time password and signs them out on every device. Remove deletes their staff account. Super admins can't be removed, demoted or reset from the panel, and nobody can remove their own account there.
Admin rights come only from is_admin: true on a user record, set by the Team page or the script below. They are never granted from an email address, because ÖRZA doesn't verify that people own the address they sign up with. Use the script to set up the first super admin, or to change roles:
node scripts/make-admin.mjs [email protected] # grant (sub-admin)
node scripts/make-admin.mjs [email protected] --super # grant as super admin
node scripts/make-admin.mjs [email protected] --sub # make a super admin a sub-admin
node scripts/make-admin.mjs [email protected] --revoke # remove admin access
node scripts/make-admin.mjs --list # list admins and their roles
A plain grant never demotes an existing super admin; pass --sub to do that. Granting admin to an existing account turns it into a staff account, so its member features disappear. Use a separate work email for staff. The script reads MONGODB_URI and MONGODB_DB from the environment, .env.local or .env. Without them it edits the local .data/orza-db.json; stop the dev server first so the server doesn't overwrite the change.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
