From 3bb100836b7e86f9009863cbf568f90c2aed200d Mon Sep 17 00:00:00 2001
From: Ben West <bewest@gmail.com>
Date: Tue, 17 Mar 2026 14:17:48 -0700
Subject: [PATCH] fix: change UUID_HANDLING default to true

Update default from false to true to enable AID client compatibility
out of the box:

- lib/server/env.js: readENVTruthy('UUID_HANDLING', true)
- README.md: Document UUID_HANDLING in Features section
- docs/example-template.env: Update comments, show true as default

Rationale:
- Loop, Trio, AAPS, xDrip+ use UUID sync patterns by default
- Before MongoDB 5.x, UUID _id didn't crash (just didn't CRUD properly)
- ObjectID users completely unaffected (quirk only triggers on UUID)
- Can set UUID_HANDLING=false for strict mode if needed

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 README.md                 |  1 +
 docs/example-template.env | 11 +++++++----
 lib/server/env.js         |  6 +++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 6258db8a..466e3893 100644
--- a/README.md
+++ b/README.md
@@ -252,6 +252,7 @@ To learn more about the Nightscout API, visit https://YOUR-SITE.com/api-docs/ or
     Setting it to `denied` will require a token from every visit, using `status-only` will enable api-secret based login.
   * `IMPORT_CONFIG` - Used to import settings and extended settings from a url such as a gist.  Structure of file should be something like: `{"settings": {"theme": "colors"}, "extendedSettings": {"upbat": {"enableAlerts": true}}}`
   * `TREATMENTS_AUTH` (`on`) - possible values `on` or `off`. Deprecated, if set to `off` the `careportal` role will be added to `AUTH_DEFAULT_ROLES`
+  * `UUID_HANDLING` (`true`) - Controls how UUID `_id` values are handled for treatments and entries. When `true` (default), UUID values in `_id` are extracted to an `identifier` field and the server generates a proper ObjectId. This enables sync with Loop, Trio, AAPS, and xDrip+ which use UUID patterns. Set to `false` for strict mode where UUID `_id` values are rejected.
 
 #### Data Rights
 
diff --git a/docs/example-template.env b/docs/example-template.env
index d1b8b40d..01e85b8e 100644
--- a/docs/example-template.env
+++ b/docs/example-template.env
@@ -15,9 +15,12 @@ NODE_ENV=development
 AUTH_FAIL_DELAY=50
 
 # UUID handling for AID clients (Loop, Trio, AAPS, xDrip+)
-# When true: UUID _id values are normalized to 'identifier' field
+# When true (default): UUID _id values are normalized to 'identifier' field
 # - POST/PUT: UUID in _id extracted to identifier, server generates ObjectId
 # - GET/DELETE: UUID _id searches by identifier field
-# When false (default): UUID _id values return empty results on read
-# Enable this if using Loop, Trio, or other apps with UUID sync patterns
-UUID_HANDLING=false
\ No newline at end of file
+# When false: Strict mode - UUID _id values rejected on write, ignored on read
+# Default is true to support Loop, Trio, AAPS, xDrip+ UUID sync patterns
+# UUID_HANDLING=true
+#
+# Set to false for strict ObjectId-only mode:
+# UUID_HANDLING=false
\ No newline at end of file
diff --git a/lib/server/env.js b/lib/server/env.js
index bdc0cafd..c75ee322 100644
--- a/lib/server/env.js
+++ b/lib/server/env.js
@@ -77,9 +77,9 @@ function setSSL () {
   env.secureCspReportOnly = readENVTruthy("SECURE_CSP_REPORT_ONLY", false);
   
   // UUID handling for AID clients (Loop, Trio, AAPS, xDrip+)
-  // When true: UUID _id values are normalized to 'identifier' field
-  // When false: UUID _id values are rejected on write, ignored on read
-  env.uuidHandling = readENVTruthy("UUID_HANDLING", false);
+  // When true (default): UUID _id values are normalized to 'identifier' field
+  // When false: UUID _id values are rejected on write, ignored on read (strict mode)
+  env.uuidHandling = readENVTruthy("UUID_HANDLING", true);
 }
 
 // A little ugly, but we don't want to read the secret into a var