docs: clarify UUID_HANDLING only affects _id field, not all UUIDs

The feature only handles the specific case where a UUID is sent as
the _id field itself. It does NOT affect:
- AAPS (uses 'identifier' field)
- xDrip+ (uses 'uuid' field)
- Loop carbs/doses (uses 'syncIdentifier' field)

Only affects:
- Loop overrides (_id: syncIdentifier.uuidString)
- Trio CGM entries (_id: UUID)

See docs/10-domain/client-id-handling-deep-dive.md for full analysis.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -252,7 +252,7 @@ To learn more about the Nightscout API, visit https://YOUR-SITE.com/api-docs/ or
     Setting it to `denied` will require a token from every visit, using `status-only` will enable api-secret based login.
   * `IMPORT_CONFIG` - Used to import settings and extended settings from a url such as a gist.  Structure of file should be something like: `{"settings": {"theme": "colors"}, "extendedSettings": {"upbat": {"enableAlerts": true}}}`
   * `TREATMENTS_AUTH` (`on`) - possible values `on` or `off`. Deprecated, if set to `off` the `careportal` role will be added to `AUTH_DEFAULT_ROLES`
-  * `UUID_HANDLING` (`true`) - Controls how UUID `_id` values are handled for treatments and entries. When `true` (default), UUID values in `_id` are extracted to an `identifier` field and the server generates a proper ObjectId. This accommodates various client sync patterns that may include UUID identifiers. Set to `false` for strict mode where UUID `_id` values are rejected.
+  * `UUID_HANDLING` (`true`) - Controls how UUID `_id` values are handled for treatments and entries. When `true` (default), if a client sends a UUID string as the `_id` field, it is moved to the `identifier` field and the server generates a proper ObjectId for `_id`. This only affects the specific case where a UUID is sent as `_id` (e.g., Loop overrides, Trio CGM entries). Set to `false` for strict mode where UUID `_id` values are rejected.
 
 #### Data Rights
 

docs/example-template.env

@@ -14,12 +14,15 @@ PORT=1337
 NODE_ENV=development
 AUTH_FAIL_DELAY=50
 
-# UUID handling for various AID client sync patterns
-# When true (default): UUID _id values are normalized to 'identifier' field
-# - POST/PUT: UUID in _id extracted to identifier, server generates ObjectId
+# UUID handling for specific client patterns that send UUID as _id field
+# Only affects cases where a UUID is sent as the _id field itself
+# (e.g., Loop overrides, Trio CGM entries)
+# Does NOT affect clients using separate identifier/uuid fields (AAPS, xDrip+, etc.)
+#
+# When true (default): UUID in _id is moved to 'identifier' field, server generates ObjectId
+# - POST/PUT: UUID _id → identifier, new ObjectId assigned
 # - GET/DELETE: UUID _id searches by identifier field
 # When false: Strict mode - UUID _id values rejected on write, ignored on read
-# Default is true to accommodate clients that may include UUID identifiers
 # UUID_HANDLING=true
 #
 # Set to false for strict ObjectId-only mode:

lib/server/env.js

@@ -76,9 +76,10 @@ function setSSL () {
   env.secureCsp = readENVTruthy("SECURE_CSP", false);
   env.secureCspReportOnly = readENVTruthy("SECURE_CSP_REPORT_ONLY", false);
   
-  // UUID handling for various AID client sync patterns
-  // When true (default): UUID _id values are normalized to 'identifier' field
+  // UUID handling for specific client patterns that send UUID as _id field
+  // When true (default): UUID _id values are moved to 'identifier' field, server generates ObjectId
   // When false: UUID _id values are rejected on write, ignored on read (strict mode)
+  // Only affects cases where UUID is sent as _id (e.g., Loop overrides, Trio CGM entries)
   env.uuidHandling = readENVTruthy("UUID_HANDLING", true);
 }