API, Backend & Frontend

backend/FIX-MEDICINE-ID-ERROR.md

@@ -0,0 +1,144 @@
+# 🔧 Solución Rápida - Error: no such column: medicine_id
+
+## ❌ El Error
+
+```
+Error: SQLITE_ERROR: no such column: medicine_id
+```
+
+Este error ocurre porque la base de datos tiene la estructura antigua que usa `medicine_id`, pero el código actualizado ahora usa `medicine_nregistro`.
+
+## ✅ Soluciones
+
+### Opción 1: Reset Completo (Recomendado para desarrollo)
+
+**Esto eliminará todos los datos actuales:**
+
+```bash
+cd backend
+
+# Método 1: Usando el script
+npm run reset-db
+
+# Método 2: Manual
+rm database.sqlite
+node seed.js
+node create-admin.js
+```
+
+### Opción 2: Migración (Mantiene farmacias, pierde vínculos medicamento-farmacia)
+
+```bash
+cd backend
+node migrate.js
+```
+
+**Nota:** Esta opción mantiene las farmacias pero elimina las relaciones medicamento-farmacia porque ahora usan un esquema diferente (nregistro de CIMA en lugar de IDs locales).
+
+### Opción 3: Manual con SQLite
+
+Si quieres más control:
+
+```bash
+cd backend
+sqlite3 database.sqlite
+
+# Dentro de SQLite:
+DROP TABLE IF EXISTS pharmacy_medicines;
+DROP INDEX IF EXISTS idx_pharmacy_medicine;
+
+CREATE TABLE pharmacy_medicines (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  pharmacy_id INTEGER NOT NULL,
+  medicine_nregistro TEXT NOT NULL,
+  medicine_name TEXT,
+  price REAL,
+  stock INTEGER DEFAULT 0,
+  FOREIGN KEY (pharmacy_id) REFERENCES pharmacies(id),
+  UNIQUE(pharmacy_id, medicine_nregistro)
+);
+
+CREATE INDEX idx_pharmacy_medicine ON pharmacy_medicines(medicine_nregistro);
+
+.quit
+```
+
+## 🔍 Verificar la Estructura
+
+Para verificar que la base de datos tiene la estructura correcta:
+
+```bash
+cd backend
+sqlite3 database.sqlite "PRAGMA table_info(pharmacy_medicines);"
+```
+
+**Salida esperada:**
+```
+0|id|INTEGER|0||1
+1|pharmacy_id|INTEGER|1||0
+2|medicine_nregistro|TEXT|1||0
+3|medicine_name|TEXT|0||0
+4|price|REAL|0||0
+5|stock|INTEGER|0|0|0
+```
+
+## 🚀 Después de la Corrección
+
+1. **Verifica que Redis esté corriendo:**
+   ```bash
+   redis-cli ping
+   # Debe responder: PONG
+   ```
+
+2. **Inicia el servidor:**
+   ```bash
+   cd backend
+   npm start
+   ```
+
+3. **Vincula medicamentos en el Admin Panel:**
+   - Ve a http://localhost:3000
+   - Haz login en el Admin Panel
+   - Ve a la pestaña "Link Medicine"
+   - Busca medicamentos desde CIMA
+   - Vincúlalos a tus farmacias
+
+## 📝 ¿Por qué cambió?
+
+La aplicación ahora usa la **API oficial de CIMA** (Agencia Española de Medicamentos) en lugar de almacenar medicamentos localmente. 
+
+**Beneficios:**
+- ✅ Datos siempre actualizados
+- ✅ Más de 30,000 medicamentos disponibles
+- ✅ Información oficial y verificada
+- ✅ Menos mantenimiento de base de datos
+
+**Estructura anterior:**
+```
+pharmacy_medicines
+  - medicine_id → ID local en tabla medicines
+```
+
+**Estructura nueva:**
+```
+pharmacy_medicines
+  - medicine_nregistro → Número de registro de CIMA
+  - medicine_name → Nombre cacheado para mostrar
+```
+
+## 💡 Preguntas Frecuentes
+
+**P: ¿Perderé mis farmacias?**  
+R: No, las farmacias se mantienen. Solo necesitas re-vincular los medicamentos.
+
+**P: ¿Perderé los vínculos medicamento-farmacia?**  
+R: Sí, porque ahora usan un sistema diferente (nregistros de CIMA). Tendrás que re-vincularlos usando el panel de admin.
+
+**P: ¿Y si tengo muchos vínculos?**  
+R: La migración vale la pena por los beneficios a largo plazo. La re-vinculación es fácil con la búsqueda en tiempo real desde CIMA.
+
+## 📚 Más Información
+
+- Ver [MIGRATION.md](./MIGRATION.md) para guía completa de migración
+- Ver [CHANGES.md](./CHANGES.md) para lista de todos los cambios
+- Ver [README.md](./README.md) para documentación general

backend/cima-service.js

@@ -0,0 +1,186 @@
+import axios from 'axios';
+import redisClient from './redis-client.js';
+
+const CIMA_API_BASE_URL = 'https://cima.aemps.es/cima/rest';
+const CACHE_TTL = 3600; // 1 hora en segundos
+
+/**
+ * CIMA's nombre filter is prefix-oriented; narrow to rows that contain every
+ * search term in the commercial name or active ingredient (full-word style).
+ */
+function filterMedicinesByFullQuery(medicines, searchTerm) {
+  const terms = searchTerm
+    .trim()
+    .toLowerCase()
+    .split(/\s+/)
+    .filter(Boolean);
+  if (terms.length === 0) return medicines;
+  return medicines.filter((m) => {
+    const hay = `${m.name || ''} ${m.active_ingredient || ''}`.toLowerCase();
+    return terms.every((term) => hay.includes(term));
+  });
+}
+
+/**
+ * Busca medicamentos en la API de CIMA con caché de Redis
+ * @param {string} query - Término de búsqueda
+ * @returns {Promise<Array>} - Lista de medicamentos encontrados
+ */
+export async function searchMedicines(query) {
+  if (!query || query.trim().length < 2) {
+    return [];
+  }
+
+  const searchTerm = query.trim().toLowerCase();
+  const cacheKey = `medicines:search:v2:${searchTerm}`;
+
+  try {
+    // Intentar obtener del caché
+    const cachedData = await redisClient.get(cacheKey);
+    
+    if (cachedData) {
+      console.log(`📦 Cache hit for: ${searchTerm}`);
+      return JSON.parse(cachedData);
+    }
+
+    // Si no está en caché, consultar la API de CIMA
+    console.log(`🌐 Fetching from CIMA API: ${searchTerm}`);
+    const response = await axios.get(`${CIMA_API_BASE_URL}/medicamentos`, {
+      params: {
+        nombre: searchTerm
+      },
+      timeout: 5000
+    });
+
+    if (response.data && response.data.resultados) {
+      // Transformar los datos de CIMA a nuestro formato
+      const medicines = response.data.resultados.map(med => ({
+        id: med.nregistro,
+        nregistro: med.nregistro,
+        name: med.nombre,
+        active_ingredient: med.vtm?.nombre || null,
+        dosage: med.dosis || null,
+        form: med.formaFarmaceutica?.nombre || null,
+        formSimplified: med.formaFarmaceuticaSimplificada?.nombre || null,
+        laboratory: med.labtitular,
+        prescription: med.cpresc,
+        commercialized: med.comerc,
+        generic: med.generico,
+        photos: med.fotos || [],
+        docs: med.docs || []
+      }));
+
+      const filtered = filterMedicinesByFullQuery(medicines, searchTerm);
+
+      // Guardar en caché
+      await redisClient.setEx(cacheKey, CACHE_TTL, JSON.stringify(filtered));
+      
+      console.log(`✅ Cached ${filtered.length} medicines for: ${searchTerm}`);
+      return filtered;
+    }
+
+    return [];
+  } catch (error) {
+    console.error('Error searching medicines from CIMA:', error.message);
+    
+    // Si falla, intentar devolver datos cacheados aunque hayan expirado
+    try {
+      const staleData = await redisClient.get(cacheKey);
+      if (staleData) {
+        console.log('⚠️ Returning stale cache data due to API error');
+        return JSON.parse(staleData);
+      }
+    } catch (cacheError) {
+      console.error('Cache fallback also failed:', cacheError);
+    }
+    
+    return [];
+  }
+}
+
+/**
+ * Obtiene detalles de un medicamento específico por su número de registro
+ * @param {string} nregistro - Número de registro del medicamento
+ * @returns {Promise<Object|null>} - Datos del medicamento
+ */
+export async function getMedicineDetails(nregistro) {
+  const cacheKey = `medicine:${nregistro}`;
+
+  try {
+    // Intentar obtener del caché
+    const cachedData = await redisClient.get(cacheKey);
+    
+    if (cachedData) {
+      console.log(`📦 Cache hit for medicine: ${nregistro}`);
+      return JSON.parse(cachedData);
+    }
+
+    // Consultar la API de CIMA
+    console.log(`🌐 Fetching medicine details from CIMA: ${nregistro}`);
+    const response = await axios.get(`${CIMA_API_BASE_URL}/medicamento/${nregistro}`, {
+      timeout: 5000
+    });
+
+    if (response.data) {
+      const med = response.data;
+      const medicineDetails = {
+        id: med.nregistro,
+        nregistro: med.nregistro,
+        name: med.nombre,
+        active_ingredient: med.principiosActivos?.[0]?.nombre || med.vtm?.nombre || null,
+        dosage: med.dosis || null,
+        form: med.formaFarmaceutica?.nombre || null,
+        formSimplified: med.formaFarmaceuticaSimplificada?.nombre || null,
+        laboratory: med.labtitular,
+        prescription: med.cpresc,
+        commercialized: med.comerc,
+        generic: med.generico,
+        photos: med.fotos || [],
+        docs: med.docs || [],
+        presentations: med.presentaciones || []
+      };
+
+      // Guardar en caché (TTL más largo para detalles específicos)
+      await redisClient.setEx(cacheKey, CACHE_TTL * 24, JSON.stringify(medicineDetails));
+      
+      return medicineDetails;
+    }
+
+    return null;
+  } catch (error) {
+    console.error(`Error fetching medicine ${nregistro} from CIMA:`, error.message);
+    
+    // Intentar devolver datos cacheados aunque hayan expirado
+    try {
+      const staleData = await redisClient.get(cacheKey);
+      if (staleData) {
+        console.log('⚠️ Returning stale cache data due to API error');
+        return JSON.parse(staleData);
+      }
+    } catch (cacheError) {
+      console.error('Cache fallback also failed:', cacheError);
+    }
+    
+    return null;
+  }
+}
+
+/**
+ * Limpia el caché de búsquedas (útil para testing o mantenimiento)
+ * @param {string} pattern - Patrón de claves a eliminar (ej: 'medicines:search:*')
+ * @returns {Promise<number>} - Número de claves eliminadas
+ */
+export async function clearCache(pattern = 'medicines:*') {
+  try {
+    const keys = await redisClient.keys(pattern);
+    if (keys.length > 0) {
+      await redisClient.del(keys);
+      console.log(`🗑️ Cleared ${keys.length} cache entries`);
+      return keys.length;
+    }
+    return 0;
+  } catch (error) {
+    console.error('Error clearing cache:', error);
+    return 0;
+  }
+}

backend/create-admin.js

@@ -0,0 +1,88 @@
+import sqlite3 from 'sqlite3';
+import { promisify } from 'util';
+import bcrypt from 'bcrypt';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const dbPath = path.join(__dirname, 'database.sqlite');
+const db = new sqlite3.Database(dbPath);
+
+// Custom wrapper to get lastID from db.run
+function dbRun(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.run(sql, params, function(err) {
+      if (err) reject(err);
+      else resolve({ lastID: this.lastID, changes: this.changes });
+    });
+  });
+}
+
+const dbGet = promisify(db.get.bind(db));
+
+// Initialize users table
+async function initDatabase() {
+  try {
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS users (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT UNIQUE NOT NULL,
+        password_hash TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+    console.log('Database table initialized');
+  } catch (error) {
+    console.error('Error initializing database:', error);
+    throw error;
+  }
+}
+
+async function createAdmin() {
+  try {
+    // Initialize database tables first
+    await initDatabase();
+
+    // Default admin credentials
+    const username = process.env.ADMIN_USERNAME || 'admin';
+    const password = process.env.ADMIN_PASSWORD || 'admin123';
+
+    // Check if admin already exists
+    const existing = await dbGet(
+      'SELECT * FROM users WHERE username = ?',
+      [username]
+    );
+
+    if (existing) {
+      console.log(`Admin user '${username}' already exists.`);
+      console.log('To change the password, delete the user first and run this script again.');
+      db.close();
+      return;
+    }
+
+    // Hash password
+    const saltRounds = 10;
+    const passwordHash = await bcrypt.hash(password, saltRounds);
+
+    // Create admin user
+    await dbRun(
+      'INSERT INTO users (username, password_hash) VALUES (?, ?)',
+      [username, passwordHash]
+    );
+
+    console.log('✅ Admin user created successfully!');
+    console.log(`Username: ${username}`);
+    console.log(`Password: ${password}`);
+    console.log('\n⚠️  IMPORTANT: Change the default password after first login!');
+    console.log('   You can set ADMIN_USERNAME and ADMIN_PASSWORD environment variables to customize.');
+  } catch (error) {
+    console.error('Error creating admin user:', error);
+  } finally {
+    db.close();
+  }
+}
+
+createAdmin();
+

backend/farmacias-webhook-import.js

@@ -0,0 +1,280 @@
+/**
+ * Fetch pharmacy lists from an n8n (or any) HTTP webhook and map into FarmaFinder rows.
+ * Default URL: FARMACIAS_WEBHOOK_URL env or the project webhook.
+ */
+
+export const DEFAULT_FARMACIAS_WEBHOOK =
+  process.env.FARMACIAS_WEBHOOK_URL ||
+  'https://n8n.hacecalor.net/webhook/farmacias';
+
+/**
+ * Append region query params, e.g. GET /webhook/farmacias?lat=41.5631&lon=2.0038&radio=1500
+ * @param {string} baseUrl - Absolute webhook URL (may already include other query params)
+ * @param {{ lat?: number|string, lon?: number|string, lng?: number|string, radio?: number|string }} region
+ */
+export function buildFarmaciasWebhookUrl(baseUrl, region = {}) {
+  const u = new URL(baseUrl);
+  const lat = region.lat;
+  const lon = region.lon ?? region.lng;
+  const radio = region.radio;
+
+  if (lat !== undefined && lat !== null && String(lat).trim() !== '') {
+    u.searchParams.set('lat', String(lat).trim());
+  }
+  if (lon !== undefined && lon !== null && String(lon).trim() !== '') {
+    u.searchParams.set('lon', String(lon).trim());
+  }
+  if (radio !== undefined && radio !== null && String(radio).trim() !== '') {
+    u.searchParams.set('radio', String(radio).trim());
+  }
+  return u.toString();
+}
+
+function pick(obj, keys) {
+  if (!obj || typeof obj !== 'object') return null;
+  for (const k of keys) {
+    if (Object.prototype.hasOwnProperty.call(obj, k)) {
+      const v = obj[k];
+      if (v !== undefined && v !== null && String(v).trim() !== '') {
+        return String(v).trim();
+      }
+    }
+  }
+  return null;
+}
+
+function toNumber(v) {
+  if (v === undefined || v === null || v === '') return null;
+  const n = typeof v === 'number' ? v : parseFloat(String(v).replace(',', '.'));
+  return Number.isFinite(n) ? n : null;
+}
+
+/**
+ * Normalize one raw record (Spanish / English field names, GeoJSON-ish).
+ */
+export function normalizePharmacyRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  if (raw.json != null && typeof raw.json === 'object' && !Array.isArray(raw.json)) {
+    return normalizePharmacyRecord(raw.json);
+  }
+
+  let name = pick(raw, [
+    'name',
+    'nombre',
+    'farmacia',
+    'titular',
+    'denominacion',
+    'denominación',
+    'razon_social',
+    'razón_social',
+    'title',
+  ]);
+  let address = pick(raw, [
+    'address',
+    'direccion',
+    'dirección',
+    'domicilio',
+    'ubicacion',
+    'ubicación',
+    'calle',
+    'full_address',
+    'direccion_completa',
+  ]);
+  const phone = pick(raw, [
+    'phone',
+    'telefono',
+    'teléfono',
+    'tel',
+    'telephone',
+    'movil',
+    'móvil',
+  ]);
+
+  let latitude = toNumber(raw.latitude ?? raw.latitud ?? raw.lat ?? raw.y);
+  let longitude = toNumber(raw.longitude ?? raw.longitud ?? raw.lng ?? raw.lon ?? raw.x);
+
+  const coords = raw.geometry?.coordinates;
+  if (Array.isArray(coords) && coords.length >= 2) {
+    if (longitude == null) longitude = toNumber(coords[0]);
+    if (latitude == null) latitude = toNumber(coords[1]);
+  }
+  if (raw.location && typeof raw.location === 'object') {
+    if (latitude == null) latitude = toNumber(raw.location.lat ?? raw.location.latitude);
+    if (longitude == null) longitude = toNumber(raw.location.lng ?? raw.location.lon ?? raw.location.longitude);
+  }
+
+  if (!name && pick(raw, ['properties'])) {
+    return normalizePharmacyRecord(raw.properties);
+  }
+
+  if (!address && name) {
+    const parts = [pick(raw, ['localidad', 'city', 'municipio']), pick(raw, ['cp', 'codigo_postal', 'postal_code'])]
+      .filter(Boolean)
+      .join(', ');
+    if (parts) address = parts;
+  }
+
+  return {
+    name: name || null,
+    address: address || null,
+    phone: phone || null,
+    latitude,
+    longitude,
+  };
+}
+
+/** n8n often returns [{ json: { ... } }, ...] */
+function unwrapN8nItemArray(arr) {
+  if (!Array.isArray(arr) || arr.length === 0) return arr || [];
+  const first = arr[0];
+  if (
+    first &&
+    typeof first === 'object' &&
+    first.json != null &&
+    typeof first.json === 'object' &&
+    !Array.isArray(first.json)
+  ) {
+    return arr.map((x) => x.json);
+  }
+  return arr;
+}
+
+export function extractPharmacyRows(payload) {
+  if (payload == null) return [];
+  let list = [];
+
+  if (Array.isArray(payload)) list = payload;
+  else if (typeof payload === 'object') {
+    const candidates = [
+      payload.farmacias,
+      payload.data,
+      payload.results,
+      payload.items,
+      payload.rows,
+      payload.records,
+      payload.pharmacies,
+      payload.body,
+      payload.output,
+    ];
+    for (const c of candidates) {
+      if (Array.isArray(c)) {
+        list = c;
+        break;
+      }
+    }
+    if (list.length === 0 && Array.isArray(payload.json)) list = payload.json;
+  }
+
+  return unwrapN8nItemArray(list);
+}
+
+export async function fetchWebhookJson(url, fetchOptions = {}) {
+  const res = await fetch(url, {
+    method: 'GET',
+    headers: { Accept: 'application/json', ...fetchOptions.headers },
+    ...fetchOptions,
+  });
+  const text = await res.text();
+  let json;
+  try {
+    json = text ? JSON.parse(text) : null;
+  } catch {
+    throw new Error(
+      `Webhook returned non-JSON (HTTP ${res.status}): ${text.slice(0, 300)}`
+    );
+  }
+  if (!res.ok) {
+    const hint = json?.message || JSON.stringify(json);
+    throw new Error(`Webhook HTTP ${res.status}: ${hint}`);
+  }
+  return json;
+}
+
+/**
+ * @param {Function} dbGet - (sql, params) => Promise<row|undefined>
+ * @param {Function} dbRun - (sql, params) => Promise<{lastID, changes}>
+ * @param {object[]} rows - raw webhook items
+ */
+/** Insert normalized pharmacy rows; exported for OSM/Google/open-data importers */
+export async function importPharmaciesFromRows(dbGet, dbRun, rows) {
+  let inserted = 0;
+  let skipped = 0;
+  let invalid = 0;
+  const errors = [];
+
+  for (let i = 0; i < rows.length; i++) {
+    const normalized = normalizePharmacyRecord(rows[i]);
+    if (!normalized?.name || !normalized?.address) {
+      invalid++;
+      continue;
+    }
+
+    const { name, address, phone, latitude, longitude } = normalized;
+
+    try {
+      const existing = await dbGet(
+        'SELECT id FROM pharmacies WHERE name = ? AND address = ?',
+        [name, address]
+      );
+      if (existing) {
+        skipped++;
+        continue;
+      }
+
+      await dbRun(
+        'INSERT INTO pharmacies (name, address, phone, latitude, longitude) VALUES (?, ?, ?, ?, ?)',
+        [name, address, phone || null, latitude, longitude]
+      );
+      inserted++;
+    } catch (err) {
+      errors.push({ index: i, message: err.message });
+    }
+  }
+
+  return { inserted, skipped, invalid, errors };
+}
+
+/**
+ * Full flow: GET webhook → parse rows → insert into DB.
+ * @param {string} [url] - Webhook base URL
+ * @param {{ lat?: number|string, lon?: number|string, lng?: number|string, radio?: number|string } | null} [region] - Optional; adds ?lat=&lon=&radio= (meters)
+ */
+export async function runFarmaciaWebhookImport(
+  dbGet,
+  dbRun,
+  url = DEFAULT_FARMACIAS_WEBHOOK,
+  region = null
+) {
+  const finalUrl =
+    region && (region.lat != null || region.lon != null || region.lng != null || region.radio != null)
+      ? buildFarmaciasWebhookUrl(url, region)
+      : url;
+
+  const json = await fetchWebhookJson(finalUrl);
+  const rows = extractPharmacyRows(json);
+
+  if (rows.length === 0) {
+    const keys = json && typeof json === 'object' ? Object.keys(json).join(', ') : typeof json;
+    const err = new Error(
+      `No pharmacy list found in webhook JSON (top-level keys: ${keys}). ` +
+        `Fix the n8n workflow so the last node returns an array or { data: [...] }.`
+    );
+    err.details = json;
+    throw err;
+  }
+
+  const stats = await importPharmaciesFromRows(dbGet, dbRun, rows);
+  const out = {
+    ...stats,
+    totalReceived: rows.length,
+    webhookUrl: finalUrl,
+  };
+  if (region && (region.lat != null || region.lon != null || region.lng != null || region.radio != null)) {
+    out.region = {
+      lat: region.lat ?? null,
+      lon: region.lon ?? region.lng ?? null,
+      radio: region.radio ?? null,
+    };
+  }
+  return out;
+}

backend/import-farmacias.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+/**
+ * CLI: pull pharmacies from webhook and insert into database.sqlite
+ *
+ *   npm run import-farmacias
+ *   FARMACIAS_WEBHOOK_URL=https://... npm run import-farmacias
+ *
+ * Region (adds ?lat=&lon=&radio= in metres), e.g. your city:
+ *   node import-farmacias.js --lat 41.5631 --lon 2.0038 --radio 1500
+ *   node import-farmacias.js "https://n8n.example/webhook/farmacias" --lat 41.5631 --lon 2.0038 --radio 1500
+ *
+ * Env defaults for region: FARMACIAS_IMPORT_LAT, FARMACIAS_IMPORT_LON, FARMACIAS_IMPORT_RADIO
+ */
+
+import sqlite3 from 'sqlite3';
+import { promisify } from 'util';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import {
+  runFarmaciaWebhookImport,
+  DEFAULT_FARMACIAS_WEBHOOK,
+} from './farmacias-webhook-import.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const dbPath = path.join(__dirname, 'database.sqlite');
+const db = new sqlite3.Database(dbPath);
+
+function dbRun(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.run(sql, params, function (err) {
+      if (err) reject(err);
+      else resolve({ lastID: this.lastID, changes: this.changes });
+    });
+  });
+}
+
+const dbGet = promisify(db.get.bind(db));
+
+function parseCli(argv) {
+  const region = {};
+  const positional = [];
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--lat' && argv[i + 1] != null) {
+      region.lat = argv[++i];
+      continue;
+    }
+    if ((a === '--lon' || a === '--lng') && argv[i + 1] != null) {
+      region.lon = argv[++i];
+      continue;
+    }
+    if (a === '--radio' && argv[i + 1] != null) {
+      region.radio = argv[++i];
+      continue;
+    }
+    if (a.startsWith('--')) {
+      console.warn('Unknown flag:', a);
+      continue;
+    }
+    positional.push(a);
+  }
+  if (process.env.FARMACIAS_IMPORT_LAT && region.lat == null) region.lat = process.env.FARMACIAS_IMPORT_LAT;
+  if (process.env.FARMACIAS_IMPORT_LON && region.lon == null) region.lon = process.env.FARMACIAS_IMPORT_LON;
+  if (process.env.FARMACIAS_IMPORT_RADIO && region.radio == null) {
+    region.radio = process.env.FARMACIAS_IMPORT_RADIO;
+  }
+  const url = positional[0] || DEFAULT_FARMACIAS_WEBHOOK;
+  const hasRegion =
+    region.lat != null || region.lon != null || region.radio != null;
+  return { url, region: hasRegion ? region : null };
+}
+
+async function main() {
+  const { url, region } = parseCli(process.argv);
+  console.log('Fetching pharmacies from:', url);
+  if (region) console.log('Region query:', region);
+
+  try {
+    const result = await runFarmaciaWebhookImport(dbGet, dbRun, url, region);
+    console.log('Done.');
+    console.log('  Total rows in response:', result.totalReceived);
+    console.log('  Inserted:', result.inserted);
+    console.log('  Skipped (duplicate name+address):', result.skipped);
+    console.log('  Invalid (missing name or address):', result.invalid);
+    if (result.errors.length) {
+      console.log('  Row errors:', result.errors.length);
+      console.log(result.errors.slice(0, 5));
+    }
+  } catch (e) {
+    console.error('Import failed:', e.message);
+    if (e.message.includes('Unused Respond to Webhook')) {
+      console.error(
+        '\n  Hint: In n8n, connect the Webhook to a single "Respond to Webhook" node, or remove unused ones.'
+      );
+    }
+    process.exitCode = 1;
+  } finally {
+    db.close();
+  }
+}
+
+main();

backend/migrate.js

@@ -0,0 +1,127 @@
+import sqlite3 from 'sqlite3';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const dbPath = path.join(__dirname, 'database.sqlite');
+const db = new sqlite3.Database(dbPath);
+
+console.log('🔄 Starting database migration...');
+
+// Promisify database operations
+function dbRun(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.run(sql, params, function(err) {
+      if (err) reject(err);
+      else resolve({ lastID: this.lastID, changes: this.changes });
+    });
+  });
+}
+
+function dbAll(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.all(sql, params, (err, rows) => {
+      if (err) reject(err);
+      else resolve(rows);
+    });
+  });
+}
+
+async function migrate() {
+  try {
+    // Check if old medicines table exists
+    const tables = await dbAll(`
+      SELECT name FROM sqlite_master 
+      WHERE type='table' AND name='medicines'
+    `);
+
+    if (tables.length > 0) {
+      console.log('📋 Found old medicines table');
+      
+      // Check if we need to migrate pharmacy_medicines
+      const columns = await dbAll(`PRAGMA table_info(pharmacy_medicines)`);
+      const hasMedicineId = columns.some(col => col.name === 'medicine_id');
+      const hasNregistro = columns.some(col => col.name === 'medicine_nregistro');
+
+      if (hasMedicineId && !hasNregistro) {
+        console.log('🔄 Migrating pharmacy_medicines table...');
+        
+        // Create new table with updated schema
+        await dbRun(`
+          CREATE TABLE pharmacy_medicines_new (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            pharmacy_id INTEGER NOT NULL,
+            medicine_nregistro TEXT NOT NULL,
+            medicine_name TEXT,
+            price REAL,
+            stock INTEGER DEFAULT 0,
+            FOREIGN KEY (pharmacy_id) REFERENCES pharmacies(id),
+            UNIQUE(pharmacy_id, medicine_nregistro)
+          )
+        `);
+
+        console.log('✅ Created new pharmacy_medicines table');
+        
+        // Copy data if any exists (though it will be invalid without nregistro)
+        const oldData = await dbAll('SELECT * FROM pharmacy_medicines');
+        console.log(`📦 Found ${oldData.length} old pharmacy-medicine relationships`);
+        
+        if (oldData.length > 0) {
+          console.log('⚠️  Warning: Old medicine relationships will be lost.');
+          console.log('   You will need to re-link medicines using the CIMA database.');
+        }
+        
+        // Drop old table
+        await dbRun('DROP TABLE pharmacy_medicines');
+        
+        // Rename new table
+        await dbRun('ALTER TABLE pharmacy_medicines_new RENAME TO pharmacy_medicines');
+        
+        console.log('✅ Migrated pharmacy_medicines table');
+      } else if (hasNregistro) {
+        console.log('✅ pharmacy_medicines table already migrated');
+      }
+
+      // We can keep the old medicines table for reference, or drop it
+      console.log('ℹ️  Old medicines table can be kept for reference or deleted manually');
+      console.log('   To delete: sqlite3 database.sqlite "DROP TABLE IF EXISTS medicines;"');
+    } else {
+      console.log('✅ No old medicines table found - creating new schema');
+      
+      // Create pharmacy_medicines table with new schema
+      await dbRun(`
+        CREATE TABLE IF NOT EXISTS pharmacy_medicines (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          pharmacy_id INTEGER NOT NULL,
+          medicine_nregistro TEXT NOT NULL,
+          medicine_name TEXT,
+          price REAL,
+          stock INTEGER DEFAULT 0,
+          FOREIGN KEY (pharmacy_id) REFERENCES pharmacies(id),
+          UNIQUE(pharmacy_id, medicine_nregistro)
+        )
+      `);
+      
+      console.log('✅ Created pharmacy_medicines table');
+    }
+
+    console.log('');
+    console.log('✨ Migration completed successfully!');
+    console.log('');
+    console.log('Next steps:');
+    console.log('1. Install Redis: brew install redis (macOS) or apt-get install redis-server (Linux)');
+    console.log('2. Start Redis: redis-server');
+    console.log('3. Install dependencies: npm install');
+    console.log('4. Start the server: npm start');
+    
+  } catch (error) {
+    console.error('❌ Migration failed:', error);
+    process.exit(1);
+  } finally {
+    db.close();
+  }
+}
+
+migrate();

backend/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "farma-finder-backend",
+  "version": "1.0.0",
+  "description": "Backend API for FarmaFinder",
+  "main": "server.js",
+  "type": "module",
+  "scripts": {
+    "start": "node server.js",
+    "dev": "node --watch server.js",
+    "seed": "node seed.js",
+    "create-admin": "node create-admin.js",
+    "migrate": "node migrate.js",
+    "reset-db": "bash reset-db.sh",
+    "import-farmacias": "node import-farmacias.js"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "express": "^4.18.2",
+    "cors": "^2.8.5",
+    "sqlite3": "^5.1.6",
+    "express-session": "^1.17.3",
+    "bcrypt": "^5.1.1",
+    "redis": "^4.6.0",
+    "axios": "^1.6.0"
+  }
+}
+

backend/redis-client.js

@@ -0,0 +1,25 @@
+import { createClient } from 'redis';
+
+// Create Redis client
+const redisClient = createClient({
+  socket: {
+    host: process.env.REDIS_HOST || 'localhost',
+    port: process.env.REDIS_PORT || 6379
+  },
+  password: process.env.REDIS_PASSWORD || undefined
+});
+
+// Error handler
+redisClient.on('error', (err) => {
+  console.error('Redis Client Error:', err);
+});
+
+// Connection handler
+redisClient.on('connect', () => {
+  console.log('✅ Connected to Redis');
+});
+
+// Connect to Redis
+await redisClient.connect();
+
+export default redisClient;

backend/reset-db.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+echo "🔄 FarmaFinder - Quick Database Reset"
+echo "===================================="
+echo ""
+echo "Este script eliminará la base de datos actual y creará una nueva."
+echo "⚠️  ADVERTENCIA: Todos los datos actuales se perderán."
+echo ""
+
+read -p "¿Continuar? (s/n): " -n 1 -r
+echo ""
+
+if [[ ! $REPLY =~ ^[Ss]$ ]]
+then
+    echo "Operación cancelada."
+    exit 1
+fi
+
+echo ""
+echo "1️⃣  Eliminando base de datos antigua..."
+rm -f database.sqlite
+
+echo "2️⃣  Creando nueva base de datos con estructura actualizada..."
+node seed.js
+
+echo "3️⃣  Creando usuario administrador..."
+node create-admin.js
+
+echo ""
+echo "✅ ¡Listo! Base de datos reiniciada con éxito."
+echo ""
+echo "Próximos pasos:"
+echo "1. Asegúrate de que Redis esté corriendo: redis-server"
+echo "2. Inicia el servidor: npm start"
+echo ""

backend/seed.js

@@ -0,0 +1,171 @@
+import sqlite3 from 'sqlite3';
+import { promisify } from 'util';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const dbPath = path.join(__dirname, 'database.sqlite');
+const db = new sqlite3.Database(dbPath);
+
+// Custom wrapper to get lastID from db.run
+function dbRun(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.run(sql, params, function(err) {
+      if (err) reject(err);
+      else resolve({ lastID: this.lastID, changes: this.changes });
+    });
+  });
+}
+
+const dbGet = promisify(db.get.bind(db));
+
+// Initialize database tables
+async function initDatabase() {
+  try {
+    // Create pharmacies table
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS pharmacies (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name TEXT NOT NULL,
+        address TEXT NOT NULL,
+        phone TEXT,
+        latitude REAL,
+        longitude REAL
+      )
+    `);
+
+    // Create medicines table
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS medicines (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name TEXT NOT NULL,
+        active_ingredient TEXT,
+        dosage TEXT,
+        form TEXT
+      )
+    `);
+
+    // Create junction table for pharmacy-medicine relationships
+    // Ahora usa nregistro (número de registro de CIMA) en lugar de medicine_id local
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS pharmacy_medicines (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        pharmacy_id INTEGER NOT NULL,
+        medicine_nregistro TEXT NOT NULL,
+        medicine_name TEXT,
+        price REAL,
+        stock INTEGER DEFAULT 0,
+        FOREIGN KEY (pharmacy_id) REFERENCES pharmacies(id),
+        UNIQUE(pharmacy_id, medicine_nregistro)
+      )
+    `);
+
+    // Create indexes for better search performance
+    await dbRun(`CREATE INDEX IF NOT EXISTS idx_medicine_name ON medicines(name)`);
+    await dbRun(`CREATE INDEX IF NOT EXISTS idx_pharmacy_medicine ON pharmacy_medicines(medicine_nregistro)`);
+
+    console.log('Database tables initialized');
+  } catch (error) {
+    console.error('Error initializing database:', error);
+    throw error;
+  }
+}
+
+// Sample data
+const pharmacies = [
+  { name: 'Farmacia Central', address: 'Av. Principal 123, Ciudad', phone: '+34 123 456 789', lat: 40.4168, lng: -3.7038 },
+  { name: 'Farmacia San José', address: 'Calle Mayor 45, Ciudad', phone: '+34 987 654 321', lat: 40.4178, lng: -3.7048 },
+  { name: 'Farmacia del Sol', address: 'Plaza del Sol 12, Ciudad', phone: '+34 555 123 456', lat: 40.4158, lng: -3.7028 },
+  { name: 'Farmacia Salud', address: 'Calle Salud 78, Ciudad', phone: '+34 666 789 012', lat: 40.4188, lng: -3.7058 },
+  { name: 'Farmacia 24h', address: 'Av. Libertad 234, Ciudad', phone: '+34 777 345 678', lat: 40.4148, lng: -3.7018 },
+];
+
+const medicines = [
+  { name: 'Paracetamol 500mg', active_ingredient: 'Paracetamol', dosage: '500mg', form: 'Tabletas' },
+  { name: 'Ibuprofeno 600mg', active_ingredient: 'Ibuprofeno', dosage: '600mg', form: 'Tabletas' },
+  { name: 'Aspirina 100mg', active_ingredient: 'Ácido Acetilsalicílico', dosage: '100mg', form: 'Tabletas' },
+  { name: 'Amoxicilina 500mg', active_ingredient: 'Amoxicilina', dosage: '500mg', form: 'Cápsulas' },
+  { name: 'Omeprazol 20mg', active_ingredient: 'Omeprazol', dosage: '20mg', form: 'Cápsulas' },
+  { name: 'Loratadina 10mg', active_ingredient: 'Loratadina', dosage: '10mg', form: 'Tabletas' },
+  { name: 'Diclofenaco 50mg', active_ingredient: 'Diclofenaco', dosage: '50mg', form: 'Tabletas' },
+  { name: 'Metformina 850mg', active_ingredient: 'Metformina', dosage: '850mg', form: 'Tabletas' },
+  { name: 'Atorvastatina 20mg', active_ingredient: 'Atorvastatina', dosage: '20mg', form: 'Tabletas' },
+  { name: 'Losartán 50mg', active_ingredient: 'Losartán', dosage: '50mg', form: 'Tabletas' },
+];
+
+async function seedDatabase() {
+  try {
+    console.log('Starting database seeding...');
+
+    // Initialize database tables first
+    await initDatabase();
+
+    // Clear existing data
+    await dbRun('DELETE FROM pharmacy_medicines');
+    await dbRun('DELETE FROM medicines');
+    await dbRun('DELETE FROM pharmacies');
+
+    // Insert pharmacies
+    const pharmacyIds = [];
+    for (const pharmacy of pharmacies) {
+      const result = await dbRun(
+        'INSERT INTO pharmacies (name, address, phone, latitude, longitude) VALUES (?, ?, ?, ?, ?)',
+        [pharmacy.name, pharmacy.address, pharmacy.phone, pharmacy.lat, pharmacy.lng]
+      );
+      pharmacyIds.push(result.lastID);
+    }
+    console.log(`Inserted ${pharmacyIds.length} pharmacies`);
+
+    // Insert medicines
+    const medicineIds = [];
+    for (const medicine of medicines) {
+      const result = await dbRun(
+        'INSERT INTO medicines (name, active_ingredient, dosage, form) VALUES (?, ?, ?, ?)',
+        [medicine.name, medicine.active_ingredient, medicine.dosage, medicine.form]
+      );
+      medicineIds.push(result.lastID);
+    }
+    console.log(`Inserted ${medicineIds.length} medicines`);
+
+    // Create pharmacy-medicine relationships
+    // Each medicine is available in 2-4 random pharmacies with random prices
+    let relationshipCount = 0;
+    for (let i = 0; i < medicineIds.length; i++) {
+      const medicineId = medicineIds[i];
+      const numPharmacies = Math.floor(Math.random() * 3) + 2; // 2-4 pharmacies
+      const selectedPharmacies = new Set();
+      
+      while (selectedPharmacies.size < numPharmacies) {
+        selectedPharmacies.add(Math.floor(Math.random() * pharmacyIds.length));
+      }
+
+      for (const pharmacyIndex of selectedPharmacies) {
+        const pharmacyId = pharmacyIds[pharmacyIndex];
+        const price = (Math.random() * 20 + 5).toFixed(2); // Random price between 5-25
+        const stock = Math.floor(Math.random() * 50) + 10; // Random stock 10-60
+
+        // NOTA: Como ahora usamos CIMA API, este seed solo crea ejemplos
+        // En producción, deberías vincular usando nregistros reales de CIMA
+        const medicine = medicines[i];
+        await dbRun(
+          'INSERT INTO pharmacy_medicines (pharmacy_id, medicine_nregistro, medicine_name, price, stock) VALUES (?, ?, ?, ?, ?)',
+          [pharmacyId, `EXAMPLE_${medicineId}`, medicine.name, price, stock]
+        );
+        relationshipCount++;
+      }
+    }
+    console.log(`Created ${relationshipCount} pharmacy-medicine relationships`);
+    console.log('⚠️  NOTA: Los medicamentos de ejemplo usan IDs ficticios.');
+
+    console.log('Database seeding completed successfully!');
+  } catch (error) {
+    console.error('Error seeding database:', error);
+  } finally {
+    db.close();
+  }
+}
+
+seedDatabase();
+

backend/server.js

@@ -0,0 +1,727 @@
+import express from 'express';
+import cors from 'cors';
+import sqlite3 from 'sqlite3';
+import { promisify } from 'util';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import session from 'express-session';
+import bcrypt from 'bcrypt';
+import { searchMedicines, getMedicineDetails } from './cima-service.js';
+import { runFarmaciaWebhookImport, DEFAULT_FARMACIAS_WEBHOOK, importPharmaciesFromRows } from './farmacias-webhook-import.js';
+import { fetchPharmaciesExternal } from '../API/index.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const app = express();
+const PORT = process.env.PORT || 3001;
+
+// Configure CORS with credentials
+app.use(cors({
+  origin: 'http://localhost:3000',
+  credentials: true
+}));
+app.use(express.json());
+
+// Configure session
+app.use(session({
+  secret: process.env.SESSION_SECRET || 'farma-finder-secret-key-change-in-production',
+  resave: false,
+  saveUninitialized: false,
+  cookie: {
+    secure: false, // Set to true in production with HTTPS
+    httpOnly: true,
+    maxAge: 24 * 60 * 60 * 1000 // 24 hours
+  }
+}));
+
+// Database setup
+const dbPath = path.join(__dirname, 'database.sqlite');
+const db = new sqlite3.Database(dbPath);
+
+// Custom wrapper to get lastID from db.run
+function dbRun(sql, params = []) {
+  return new Promise((resolve, reject) => {
+    db.run(sql, params, function(err) {
+      if (err) reject(err);
+      else resolve({ lastID: this.lastID, changes: this.changes });
+    });
+  });
+}
+
+const dbAll = promisify(db.all.bind(db));
+const dbGet = promisify(db.get.bind(db));
+
+// Initialize database tables
+async function initDatabase() {
+  try {
+    // Create pharmacies table
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS pharmacies (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name TEXT NOT NULL,
+        address TEXT NOT NULL,
+        phone TEXT,
+        latitude REAL,
+        longitude REAL
+      )
+    `);
+
+    // Create medicines table
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS medicines (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name TEXT NOT NULL,
+        active_ingredient TEXT,
+        dosage TEXT,
+        form TEXT
+      )
+    `);
+
+    // Create junction table for pharmacy-medicine relationships
+    // Ahora usa nregistro (número de registro de CIMA) en lugar de medicine_id local
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS pharmacy_medicines (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        pharmacy_id INTEGER NOT NULL,
+        medicine_nregistro TEXT NOT NULL,
+        medicine_name TEXT,
+        price REAL,
+        stock INTEGER DEFAULT 0,
+        FOREIGN KEY (pharmacy_id) REFERENCES pharmacies(id),
+        UNIQUE(pharmacy_id, medicine_nregistro)
+      )
+    `);
+
+    // Create indexes for better search performance
+    await dbRun(`CREATE INDEX IF NOT EXISTS idx_medicine_name ON medicines(name)`);
+    await dbRun(`CREATE INDEX IF NOT EXISTS idx_pharmacy_medicine ON pharmacy_medicines(medicine_nregistro)`);
+
+    // Create users table for authentication
+    await dbRun(`
+      CREATE TABLE IF NOT EXISTS users (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        username TEXT UNIQUE NOT NULL,
+        password_hash TEXT NOT NULL,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+
+    console.log('Database initialized successfully');
+  } catch (error) {
+    console.error('Error initializing database:', error);
+  }
+}
+
+// API Routes
+
+// Search medicines using CIMA API with Redis cache
+app.get('/api/medicines/search', async (req, res) => {
+  try {
+    const query = req.query.q || '';
+    
+    if (!query.trim()) {
+      return res.json([]);
+    }
+
+    // Usar el servicio de CIMA con caché de Redis
+    const medicines = await searchMedicines(query);
+
+    res.json(medicines);
+  } catch (error) {
+    console.error('Error searching medicines:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get pharmacies that sell a specific medicine (usando nregistro de CIMA)
+app.get('/api/medicines/:medicineId/pharmacies', async (req, res) => {
+  try {
+    const nregistro = req.params.medicineId; // Ahora es el nregistro de CIMA
+
+    const pharmacies = await dbAll(`
+      SELECT 
+        p.id,
+        p.name,
+        p.address,
+        p.phone,
+        p.latitude,
+        p.longitude,
+        pm.price,
+        pm.stock
+      FROM pharmacies p
+      INNER JOIN pharmacy_medicines pm ON p.id = pm.pharmacy_id
+      WHERE pm.medicine_nregistro = ?
+      ORDER BY p.name
+    `, [nregistro]);
+
+    res.json(pharmacies);
+  } catch (error) {
+    console.error('Error fetching pharmacies:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get medicine details from CIMA API (usando nregistro)
+app.get('/api/medicines/:medicineId', async (req, res) => {
+  try {
+    const nregistro = req.params.medicineId; // Ahora es el nregistro de CIMA
+
+    const medicine = await getMedicineDetails(nregistro);
+
+    if (!medicine) {
+      return res.status(404).json({ error: 'Medicine not found' });
+    }
+
+    res.json(medicine);
+  } catch (error) {
+    console.error('Error fetching medicine:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get all pharmacies (for admin/debugging)
+app.get('/api/pharmacies', async (req, res) => {
+  try {
+    const pharmacies = await dbAll(`
+      SELECT * FROM pharmacies ORDER BY name
+    `);
+    res.json(pharmacies);
+  } catch (error) {
+    console.error('Error fetching pharmacies:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// ========== AUTHENTICATION MIDDLEWARE ==========
+
+// Middleware to check if user is authenticated
+const requireAuth = (req, res, next) => {
+  if (req.session && req.session.userId) {
+    return next();
+  }
+  return res.status(401).json({ error: 'Authentication required' });
+};
+
+// ========== AUTHENTICATION ROUTES ==========
+
+// Login endpoint
+app.post('/api/auth/login', async (req, res) => {
+  try {
+    const { username, password } = req.body;
+
+    if (!username || !password) {
+      return res.status(400).json({ error: 'Username and password are required' });
+    }
+
+    // Find user by username
+    const user = await dbGet(
+      'SELECT * FROM users WHERE username = ?',
+      [username.trim()]
+    );
+
+    if (!user) {
+      return res.status(401).json({ error: 'Invalid username or password' });
+    }
+
+    // Verify password
+    const isValidPassword = await bcrypt.compare(password, user.password_hash);
+
+    if (!isValidPassword) {
+      return res.status(401).json({ error: 'Invalid username or password' });
+    }
+
+    // Create session
+    req.session.userId = user.id;
+    req.session.username = user.username;
+
+    res.json({
+      message: 'Login successful',
+      user: {
+        id: user.id,
+        username: user.username
+      }
+    });
+  } catch (error) {
+    console.error('Error during login:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Logout endpoint
+app.post('/api/auth/logout', (req, res) => {
+  req.session.destroy((err) => {
+    if (err) {
+      console.error('Error destroying session:', err);
+      return res.status(500).json({ error: 'Error logging out' });
+    }
+    res.json({ message: 'Logout successful' });
+  });
+});
+
+// Check authentication status
+app.get('/api/auth/check', (req, res) => {
+  if (req.session && req.session.userId) {
+    res.json({
+      authenticated: true,
+      user: {
+        id: req.session.userId,
+        username: req.session.username
+      }
+    });
+  } else {
+    res.json({ authenticated: false });
+  }
+});
+
+// ========== ADMIN API ROUTES ==========
+
+/** Suggested search radius (m) from Nominatim bounding box [south, north, west, east] */
+function radiusMetersFromBoundingBox(south, north, west, east) {
+  const s = parseFloat(south);
+  const n = parseFloat(north);
+  const w = parseFloat(west);
+  const e = parseFloat(east);
+  if (![s, n, w, e].every(Number.isFinite)) return null;
+  const latMid = (s + n) / 2;
+  const latM = Math.abs(n - s) * 111320;
+  const lonM = Math.abs(e - w) * 111320 * Math.cos((latMid * Math.PI) / 180);
+  const half = (Math.max(latM, lonM) / 2) * 1.12;
+  return Math.round(Math.min(Math.max(half, 1500), 50000));
+}
+
+async function nominatimSearchFirstHit(originalQuery) {
+  const trimmed = originalQuery.trim();
+  const variants = [
+    trimmed,
+    `${trimmed}, España`,
+    `${trimmed}, Spain`,
+    `${trimmed}, ES`,
+  ];
+  const seen = new Set();
+  const uniqueVariants = variants.filter((v) => {
+    const k = v.toLowerCase();
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+
+  const delay = (ms) => new Promise((r) => setTimeout(r, ms));
+
+  for (let i = 0; i < uniqueVariants.length; i++) {
+    const q = uniqueVariants[i];
+    if (i > 0) await delay(1100);
+    const params = new URLSearchParams({
+      format: 'json',
+      limit: '1',
+      q,
+      addressdetails: '0',
+    });
+    const url = `https://nominatim.openstreetmap.org/search?${params}`;
+    const nomRes = await fetch(url, {
+      headers: {
+        Accept: 'application/json',
+        'Accept-Language': 'es,en',
+        'User-Agent':
+          'FarmaFinder/1.0 (pharmacy admin; geocoding; https://github.com/)',
+      },
+    });
+    const text = await nomRes.text();
+    let data;
+    try {
+      data = text ? JSON.parse(text) : [];
+    } catch {
+      return { ok: false, error: 'Geocoder returned invalid JSON', status: 502 };
+    }
+    if (!nomRes.ok) {
+      return {
+        ok: false,
+        error: `Geocoder HTTP ${nomRes.status}`,
+        status: 502,
+      };
+    }
+    if (Array.isArray(data) && data.length > 0) {
+      return { ok: true, hit: data[0], triedQuery: q };
+    }
+  }
+
+
+  return {
+    ok: false,
+    error:
+      'No place found. Try adding the region (e.g. "Rubí, Barcelona" or "Toledo, Spain").',
+    status: 422,
+  };
+}
+
+// Geocode city → lat, lon, radius (OpenStreetMap Nominatim; admin-only, low volume)
+app.get('/api/admin/geocode', requireAuth, async (req, res) => {
+  const q = (req.query.q || '').trim();
+  if (!q) {
+    return res.status(400).json({ error: 'Query parameter q is required' });
+  }
+  try {
+    const result = await nominatimSearchFirstHit(q);
+    if (!result.ok) {
+      return res.status(result.status).json({ error: result.error });
+    }
+    const hit = result.hit;
+    const lat = parseFloat(hit.lat);
+    const lon = parseFloat(hit.lon);
+    if (!Number.isFinite(lat) || !Number.isFinite(lon)) {
+      return res.status(502).json({ error: 'Geocoder result missing coordinates' });
+    }
+    let radius = 12000;
+    if (hit.boundingbox && hit.boundingbox.length >= 4) {
+      const r = radiusMetersFromBoundingBox(
+        hit.boundingbox[0],
+        hit.boundingbox[1],
+        hit.boundingbox[2],
+        hit.boundingbox[3]
+      );
+      if (r != null) radius = r;
+    }
+    res.json({
+      lat,
+      lon,
+      radius,
+      displayName: hit.display_name || q,
+      matchedQuery: result.triedQuery,
+    });
+  } catch (err) {
+    console.error('Geocode error:', err);
+    res.status(500).json({ error: err.message || 'Geocode failed' });
+  }
+});
+
+// Add a new pharmacy
+app.post('/api/admin/pharmacies', requireAuth, async (req, res) => {
+  try {
+    const { name, address, phone, latitude, longitude } = req.body;
+
+    if (!name || !address) {
+      return res.status(400).json({ error: 'Name and address are required' });
+    }
+
+    // Check for duplicate (same name and address)
+    const existing = await dbGet(
+      'SELECT * FROM pharmacies WHERE name = ? AND address = ?',
+      [name.trim(), address.trim()]
+    );
+
+    if (existing) {
+      return res.status(400).json({ error: 'A pharmacy with this name and address already exists' });
+    }
+
+    const result = await dbRun(
+      'INSERT INTO pharmacies (name, address, phone, latitude, longitude) VALUES (?, ?, ?, ?, ?)',
+      [name.trim(), address.trim(), phone ? phone.trim() : null, latitude || null, longitude || null]
+    );
+
+    if (!result || result.lastID === undefined) {
+      throw new Error('Failed to get lastID from database insert');
+    }
+
+    const newPharmacy = await dbGet(
+      'SELECT * FROM pharmacies WHERE id = ?',
+      [result.lastID]
+    );
+
+    if (!newPharmacy) {
+      throw new Error('Failed to retrieve created pharmacy');
+    }
+
+    res.status(201).json(newPharmacy);
+  } catch (error) {
+    console.error('Error adding pharmacy:', error);
+    if (error.message.includes('UNIQUE constraint')) {
+      res.status(400).json({ error: 'A pharmacy with this information already exists' });
+    } else {
+      res.status(500).json({ error: error.message || 'Internal server error' });
+    }
+  }
+});
+
+// Update a pharmacy
+app.put('/api/admin/pharmacies/:id', requireAuth, async (req, res) => {
+  try {
+    const pharmacyId = parseInt(req.params.id);
+    const { name, address, phone, latitude, longitude } = req.body;
+
+    if (!name || !address) {
+      return res.status(400).json({ error: 'Name and address are required' });
+    }
+
+    await dbRun(
+      'UPDATE pharmacies SET name = ?, address = ?, phone = ?, latitude = ?, longitude = ? WHERE id = ?',
+      [name, address, phone || null, latitude || null, longitude || null, pharmacyId]
+    );
+
+    const updatedPharmacy = await dbGet(
+      'SELECT * FROM pharmacies WHERE id = ?',
+      [pharmacyId]
+    );
+
+    if (!updatedPharmacy) {
+      return res.status(404).json({ error: 'Pharmacy not found' });
+    }
+
+    res.json(updatedPharmacy);
+  } catch (error) {
+    console.error('Error updating pharmacy:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Delete a pharmacy
+app.delete('/api/admin/pharmacies/:id', requireAuth, async (req, res) => {
+  try {
+    const pharmacyId = parseInt(req.params.id);
+
+    // Delete related pharmacy_medicines first
+    await dbRun('DELETE FROM pharmacy_medicines WHERE pharmacy_id = ?', [pharmacyId]);
+    
+    // Delete the pharmacy
+    await dbRun('DELETE FROM pharmacies WHERE id = ?', [pharmacyId]);
+
+    res.json({ message: 'Pharmacy deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting pharmacy:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Import pharmacies from webhook (e.g. n8n).
+// Body: { "url"?: string, "lat"?, "lon"|"lng"?, "radio"? } — lat/lon/radio add ?lat=&lon=&radio= (metres)
+app.post('/api/admin/pharmacies/import-webhook', requireAuth, async (req, res) => {
+  try {
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    const url =
+      (typeof body.url === 'string' && body.url.trim()) ||
+      process.env.FARMACIAS_WEBHOOK_URL ||
+      DEFAULT_FARMACIAS_WEBHOOK;
+    const region = {};
+    if (body.lat != null && String(body.lat).trim() !== '') region.lat = body.lat;
+    const lonVal = body.lon ?? body.lng;
+    if (lonVal != null && String(lonVal).trim() !== '') region.lon = lonVal;
+    if (body.radio != null && String(body.radio).trim() !== '') region.radio = body.radio;
+    const hasRegion =
+      region.lat != null || region.lon != null || region.radio != null;
+    const result = await runFarmaciaWebhookImport(
+      dbGet,
+      dbRun,
+      url.trim(),
+      hasRegion ? region : null
+    );
+    res.json(result);
+  } catch (error) {
+    console.error('Webhook pharmacy import:', error);
+    const status = error.message?.includes('HTTP') ? 502 : 400;
+    res.status(status).json({
+      error: error.message || 'Webhook import failed',
+      ...(error.details ? { details: error.details } : {}),
+    });
+  }
+});
+
+// Import from OpenStreetMap (Overpass), or a JSON open-data URL — see /API
+app.post('/api/admin/pharmacies/import-external', requireAuth, async (req, res) => {
+  try {
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    const source = body.source;
+    if (!['osm', 'openData'].includes(source)) {
+      return res
+        .status(400)
+        .json({ error: 'source must be "osm", or "openData"' });
+    }
+
+    const rows = await fetchPharmaciesExternal({
+      source,
+      lat: body.lat,
+      lon: body.lon ?? body.lng,
+      lng: body.lng,
+      radio: body.radio,
+      openDataUrl:
+        typeof body.openDataUrl === 'string' ? body.openDataUrl.trim() : undefined,
+    });
+
+    if (!rows.length) {
+      return res.json({
+        inserted: 0,
+        skipped: 0,
+        invalid: 0,
+        errors: [],
+        totalReceived: 0,
+        source,
+        message: 'No pharmacies returned for this query',
+      });
+    }
+
+    const stats = await importPharmaciesFromRows(dbGet, dbRun, rows);
+    res.json({ ...stats, totalReceived: rows.length, source });
+  } catch (error) {
+    console.error('External pharmacy import:', error);
+    res.status(400).json({ error: error.message || 'External import failed' });
+  }
+});
+
+// Search medicines from CIMA API (para el admin)
+app.get('/api/admin/medicines', requireAuth, async (req, res) => {
+  try {
+    const query = req.query.q || '';
+    
+    if (!query.trim()) {
+      // Si no hay query, retornar lista vacía o medicamentos populares
+      return res.json([]);
+    }
+
+    // Usar el servicio de CIMA
+    const medicines = await searchMedicines(query);
+    res.json(medicines);
+  } catch (error) {
+    console.error('Error fetching medicines:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// NOTA: Ya no necesitamos endpoints para crear/editar medicamentos localmente
+// porque ahora usamos la API de CIMA como fuente de verdad
+
+// Add a new medicine (DEPRECATED - mantenido solo para compatibilidad)
+app.post('/api/admin/medicines', requireAuth, async (req, res) => {
+  try {
+    // Ya no se agregan medicamentos localmente, se obtienen de CIMA
+    return res.status(400).json({ 
+      error: 'Medicine management has been moved to CIMA API. Use the search feature to find medicines.' 
+    });
+  } catch (error) {
+    console.error('Error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Update a medicine (DEPRECATED - mantenido solo para compatibilidad)
+app.put('/api/admin/medicines/:id', requireAuth, async (req, res) => {
+  try {
+    return res.status(400).json({ 
+      error: 'Medicine management has been moved to CIMA API.' 
+    });
+  } catch (error) {
+    console.error('Error updating medicine:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get medicines for a specific pharmacy (usando nregistro)
+app.get('/api/admin/pharmacies/:pharmacyId/medicines', requireAuth, async (req, res) => {
+  try {
+    const pharmacyId = parseInt(req.params.pharmacyId);
+
+    const medicines = await dbAll(`
+      SELECT 
+        pm.id,
+        pm.pharmacy_id,
+        pm.medicine_nregistro,
+        pm.medicine_name,
+        pm.price,
+        pm.stock
+      FROM pharmacy_medicines pm
+      WHERE pm.pharmacy_id = ?
+      ORDER BY pm.medicine_name
+    `, [pharmacyId]);
+
+    res.json(medicines);
+  } catch (error) {
+    console.error('Error fetching pharmacy medicines:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Add medicine to a pharmacy (or update if exists) usando nregistro de CIMA
+app.post('/api/admin/pharmacy-medicines', requireAuth, async (req, res) => {
+  try {
+    const { pharmacy_id, medicine_nregistro, medicine_name, price, stock } = req.body;
+
+    if (!pharmacy_id || !medicine_nregistro) {
+      return res.status(400).json({ error: 'Pharmacy ID and Medicine nregistro are required' });
+    }
+
+    // Check if relationship already exists
+    const existing = await dbGet(
+      'SELECT * FROM pharmacy_medicines WHERE pharmacy_id = ? AND medicine_nregistro = ?',
+      [pharmacy_id, medicine_nregistro]
+    );
+
+    if (existing) {
+      // Update existing relationship
+      await dbRun(
+        'UPDATE pharmacy_medicines SET medicine_name = ?, price = ?, stock = ? WHERE pharmacy_id = ? AND medicine_nregistro = ?',
+        [medicine_name, price || null, stock || 0, pharmacy_id, medicine_nregistro]
+      );
+    } else {
+      // Insert new relationship
+      await dbRun(
+        'INSERT INTO pharmacy_medicines (pharmacy_id, medicine_nregistro, medicine_name, price, stock) VALUES (?, ?, ?, ?, ?)',
+        [pharmacy_id, medicine_nregistro, medicine_name, price || null, stock || 0]
+      );
+    }
+
+    const relationship = await dbGet(
+      `SELECT * FROM pharmacy_medicines
+       WHERE pharmacy_id = ? AND medicine_nregistro = ?`,
+      [pharmacy_id, medicine_nregistro]
+    );
+
+    res.status(201).json(relationship);
+  } catch (error) {
+    console.error('Error adding medicine to pharmacy:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Update pharmacy-medicine relationship
+app.put('/api/admin/pharmacy-medicines/:id', requireAuth, async (req, res) => {
+  try {
+    const id = parseInt(req.params.id);
+    const { price, stock } = req.body;
+
+    await dbRun(
+      'UPDATE pharmacy_medicines SET price = ?, stock = ? WHERE id = ?',
+      [price || null, stock || 0, id]
+    );
+
+    const updated = await dbGet(
+      'SELECT * FROM pharmacy_medicines WHERE id = ?',
+      [id]
+    );
+
+    if (!updated) {
+      return res.status(404).json({ error: 'Relationship not found' });
+    }
+
+    res.json(updated);
+  } catch (error) {
+    console.error('Error updating pharmacy-medicine:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Delete pharmacy-medicine relationship
+app.delete('/api/admin/pharmacy-medicines/:id', requireAuth, async (req, res) => {
+  try {
+    const id = parseInt(req.params.id);
+    await dbRun('DELETE FROM pharmacy_medicines WHERE id = ?', [id]);
+    res.json({ message: 'Medicine removed from pharmacy successfully' });
+  } catch (error) {
+    console.error('Error deleting pharmacy-medicine:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Start server
+initDatabase().then(() => {
+  app.listen(PORT, () => {
+    console.log(`Server running on http://localhost:${PORT}`);
+  });
+});
+