7 Commits

Author	SHA1	Message	Date
jacobh2	4fa79bad77	Merge branch 'worktree-check-security-audit' ... Security and frontend-correctness hardening: analytics IDOR fix, scraper log scrubbing, lowercase email normalisation (migration 009), stale-response guards in the plan hooks, busy flags cleared unconditionally across all useLatestRequest consumers, Calendar no longer blanks on mutation, plus dependabot/CI config and removal of the stray frontend/out.js. Conflicts came from main's later "day assertions" restructure, which made usePlannedDays read-only and replaced the calendar's per-day add/update with useDayAssertions.assertDay. Both intents kept: - usePlannedDays: branch's fetch machinery (isRefreshing, in-flight dedup, unguarded busy clear); mutators dropped as on main. - usePlanSync: branch's useLatestRequest guard also applied to main's new syncWithWish. - useDayAssertions / useLatestBalance (new on main): busy flag now cleared unconditionally, as the branch did for every other consumer. - useDayAssertions.assertDay gains the branch's `skipRefresh` option and a `refresh`, so Calendar's multi-day save keeps the batch shape (N writes, one trailing bumpPlanVersion + one assertions refresh) on main's assertDay path. Branch's M7 tests ported from the removed add/update API to assertDay. - PlanSyncProvider: branch's isAuthenticated gate kept; eviction-preview state stays removed as on main. - usePlannedDayExclusions.ts stays deleted (superseded by useDayAssertions). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV	2026-09-21 07:40:09 +02:00
jacobh2	782415122d	Separate user intent from planner output via day assertions ... The calendar mixed two kinds of truth in one table. `planned_leave_day` was simultaneously the allocator's output cache, the user's override store (`is_pinned`, plus ad-hoc rows with no `wish_id`), and the resource ledger that analytics and the age-4 maths read. The planner therefore had to ask "am I allowed to touch this row?" on every sync, and got it wrong at the edges. Every user assertion is now one `day_assertion` row — a concrete `day_type` replaces a pinned day, a row with no `wish_id` replaces an ad-hoc day, and `day_type='none'` replaces `planned_day_exclusion`. `planned_leave_day` becomes purely derived with a single writer, and `PlanningService.pinned_keys()` is the single answer to "is this day pinned", used by the allocator's loader, by `sync_plan` and by the read router alike. On top of that, every calendar band is now a real event: an ad-hoc band opens the same full editor as a wish-backed one and saving it promotes it to a `LeaveWish`, so it can be named, repeated yearly, assigned to either or both parents, and handed to the planner. "Planering" is a `moveable` toggle plus a from/to month bound plus a separate lock/unlock action on the days themselves, replacing a three-rung ladder whose "planner decides" rung set a search window equal to the drawn dates and so could never move anything. Bugs found and fixed along the way: - The plan erased its own history. Fixed windows clip to today, so an elapsed auto-placed day fell into `stale_keys` and was deleted on the next sync — and a background sync runs on every workspace load. Past rows are now frozen and counted as spent. - Migration 010's downgrade silently destroyed every pinned day and exclusion (`is_pinned` returned as DEFAULT 0, the exclusion table came back empty, exit 0, no warning). It now reconstructs both from `day_assertion`, and 009 itemises what it cannot recover before dropping the table. - Deleting a period left its assertions behind, locking those dates forever with no UI path to clear them. Wish deletion now clears them by `wish_id`. - `DayAssertionService` and `LeaveWishService` committed multi-statement writes without a transaction; a crash mid-write diverged the tables or half-deleted a series. Both now run in a unit of work. - A sibling year's shortfall was never surfaced: the toast only inspected the edited occurrence's outcome, so a fully unfunded later year rendered as an empty band with no warning. - A flexible window whose bound had entirely elapsed was dropped from the proposal with no outcome at all. It now reports as `unplaced`. - Unlocking a period deleted its days instead of returning them to the planner. - The e2e global setup posted to a route deleted in this change, which would have failed the whole suite before its first test. Gates: backend 938 tests / 91% coverage, frontend 1351 / 97.4 | 92.2 | 94.37 | 97.4. Migrations 009 and 010 audited against a hand-built realistic database: the upgrade reconciles exactly and a constraint violation fails safe, leaving the schema at 008. Not complete. Step 4's toggle, month picker and lock/unlock action are verified by browser walk and unit tests, but the partial-lock readout was not exercised. `ideas.md` §7 adds a full plan for the vacation-forfeiture defect (the planner detects expiring days and then does nothing about them) — not implemented here. Remaining smaller items are listed in the session's restructure notes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV	2026-09-21 07:20:14 +02:00
jacobh2	88197060de	Close the residual gaps the 2026-09-18 audit left open ... Re-checked every item of the audit's own outcome section against the tree. Most held, but five items marked fixed had residual gaps — one of them a live IDOR — and the deferred list was untouched. Security: - Analytics IDOR: /api/analytics/{ws}/overview and /projection took child_id as an unchecked query param, and get_overview called get_days_left_at_age_4 without workspace_id, so the ownership guard never ran. Any member could read another workspace's child projection. Fixed at both layers. - Scraper: session ids no longer logged at INFO; a persist-callback failure's raw exception text and the FK maintenance banner's scraped text no longer reach the poll client. - Email is now case-normalised at the API boundary, with migration 009 lowercasing existing rows (aborts naming colliding rows rather than failing opaquely on the UNIQUE constraint). Frontend correctness: - usePlanProposal/usePlanSync gained the stale-response guard the other hooks already had. - PlanSyncProvider no longer fires POST /plan/sync before auth resolves off a blindly-read localStorage workspaceId. - Busy flags are cleared unconditionally across all 16 useLatestRequest consumers. setBusy(true) was unconditional while the clear was guarded by isCurrent, so a superseded call stranded its flag forever — under StrictMode this hung every in-app navigation behind the PageSkeleton. isCurrent decides which response's data wins, never whether a call releases the flag it raised. Performance: - Calendar no longer blanks on a mutation, and a multi-day save issues N writes plus one background refetch instead of 2N requests. - take_pl_on_red_days moved onto GET /auth/context, dropping a redundant GET /workspace/:id from every cold load. CI and repo hygiene: least-privilege permissions block, actions pinned to commit SHAs, npm ci, uv sync --locked, failure-only artifact upload, dependabot; dead frontend/out.js removed; CSP added to the nginx template (repeated into the location blocks that set their own add_header, since nginx does not merge them across levels). Left deferred by decision: refresh-token revocation, the phase-2 contract change, M4, M5, L2, and H12's cross-route cache. Details and the smaller follow-ups browser verification turned up are in the audit report. Backend 901 passed, coverage 92%. Frontend 1322 tests, coverage 98.17/94.79/92.14/98.17. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PngVF38MLpdkgXcByKfdW6	2026-09-21 06:16:23 +02:00
jacobh2	0e9b20ec37	Track preschool planning days, partner invites and real vacation forfeiture ... Three strands of work that grew together across the same settings screen and API client, so they land as one change. Per-year preschool planning days ("studiedagar"): new table, repository (SQLite + Postgres), service, router and migration 007, plus the hooks and Settings UI to plan and record them per child and year. Allocation now reserves the recorded figure for a year where one exists and only falls back to the child-level estimate otherwise, marking that fallback as assumed. Partner invitations: workspaces issue and list invitations, registration accepts an invite token to join the inviter's workspace instead of creating a personal one, and a /join/:token page plus the settings invite panel drive it. Vacation forfeiture: tips and the dashboard now distinguish days a parent genuinely loses from days that merely age, so the warning stops firing on balances that were never at risk. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-20 11:22:07 +02:00
jacobh2	6d92b87bf3	Give every year of a repeating period its own row ... A repeating period was a single row that the planner expanded into one window per year at read time, so no year had anywhere to differ from the others. Editing one year rewrote them all, and removing a year in the middle had to split the wish in two. Neither survives contact with the thing this app is for: Easter moves, and the cheapest week is not the same week every year. Each year is now its own row, linked by a series id. Editing one year touches one row; editing the series re-projects the rest from it. Removing a year is one delete. The weekday snap is worked out once, when the rows are made, and stored, so a row now says what it means rather than being re-derived on every read. Recurrence stops being a stored field and becomes what it always was in practice — an instruction at create and update time; whether a period repeats is whether it belongs to a series. Migration 004 rebuilds the table and expands the existing rows, keeping each original row as its first year so the days already planned against it still point somewhere. A Feb 29 anchor recurring into a common year used to raise out of the allocator; it clamps now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ei7gCZzdd751uZtPzb1Pep	2026-09-19 15:53:25 +02:00
jacobh2	e4719cb9ae	Rework balances around per-parent days left and deduce the partner from FK ... Manual entry now takes one parent's sjukpenningnivå, lägstanivå and dubbeldagar left (plus optional reserved days) and derives the rest in build_snapshot, shared with the scraper. The scraper also reads the family panel and exposes a partner deduction; with two parents it is saved as a 'deduced' snapshot (migration 002). Parent count is the single source of entitlement: one member gets 480 days and 96 savable at age 4, two get 240 and 48 each. Workspaces are capped at two parents. Also lands the in-flight squash of migrations 002–011 into the initial schema and the removal of planning_mode. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-19 12:27:29 +02:00
jacobh2	02db5430eb	Harden the API and the data layer after a security and performance audit ... Security - Every route now requires a login and refuses ids outside the caller's workspace with 404: plan, leave-wishes, day-overrides and vacation-days were fully anonymous; every other router trusted client-supplied workspace/child/parent ids. Scraper sessions are bound to their owner. - Invitations can no longer be created for a foreign workspace, and a redeemer who is already a member (or a full workspace) is refused. - Production refuses the default JWT secret; API docs are hidden in production; a failed migration aborts startup instead of serving. - Login and register no longer reveal whether an email exists; inactive accounts are rejected; /auth/refresh is rate limited. - The FK scraper writes debug artefacts only when explicitly enabled, logs no scraped values or page text, clears the BankID QR as soon as it is scanned and purges finished sessions after five minutes. - Real FK page captures are removed from the tree (history rewrite follows); the parser tests use a synthetic fixture. Performance and correctness - Plan apply/sync run inside one locked transaction with batched writes instead of one commit per row, so a failure mid-batch leaves nothing half-applied and concurrent syncs no longer corrupt each other. - SQLite runs in WAL mode with a busy timeout; 14 indexes cover the filters that were full scans; argon2 hashing runs off the event loop; responses are gzipped. - Frontend: a 401 now refreshes the token once and retries, so sessions no longer die silently after 15 minutes; every data hook discards stale responses; logout clears state even when the server call fails. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CsXCCcDfmV4Sps4ZQSvNEY	2026-09-18 07:54:21 +02:00