66 Commits

Author	SHA1	Message	Date
Maurice	7e8e342e29	fix(mobile): stay editor and save to list match the common sheet header ... Their icon tiles match TileHeader's (40 px, ink icon) and the stay editor's search field is round like the others.	2026-11-06 16:50:46 +01:00
jubnl	d7c4324afc	chore(capacitor): base files for capacitor (#2020) ... * chore(capacitor): base files for capacitor * chore(capacitor): base plugins * feat(auth): hand a browser sign-in over to the native app The native apps show the server's own UI in a WebView, where neither SSO nor passkeys can run. They sign in through the system browser instead and need a way to carry that session back. The app keeps a random verifier and sends only its sha256 into the browser. Once signed in there, the browser trades that challenge for a one-time code (cookie session only, so an API or MCP token cannot mint itself a browser session), and the WebView redeems the code together with the verifier. The code rides through a URL scheme any app could claim, so on its own it is worthless; it is single use and good for a minute. Also: /api/health/features reports nativeApp so the apps can refuse servers that predate this, and hashed files under assets/ are served immutable, which the iOS app needs to start offline without a service worker. * feat(native): the apps load the server's own UI The apps ship only an address screen now. Once a server is picked, the native side points the WebView at it: TrekBridgeViewController on iOS and a config copy with server.url on Android. The UI then comes from that server, in the version it runs and on its own origin, so the session cookie, uploads, /ws and plugins work exactly as in a browser and no app release has to keep pace with the servers out there. The address screen (native-shell/, built into native-dist/) probes /api/health/features through native HTTP, tries https before http when no scheme was typed, and refuses servers without the nativeApp flag. It also serves as the error page when the remembered server does not load: retry, change server, or on iOS the stored copy of the server's start page. TrekShell is the app's own plugin for all of that: remember, change and reload the server, sign in through ASWebAuthenticationSession or a Custom Tab, and on iOS keep and open the offline copy of the start page, because WKWebView runs no service worker for a domain the app does not list. Plugins the frame does not use are gone (push, camera, geolocation, calendar, file transfer, in-app browser and more): the WebView covers the camera and location itself, and push needs a relay before it is worth shipping. With them go the push entitlement, the calendar usage strings and the Firebase bits. The iOS scheme falls back to capacitor://, since Capacitor drops an iosScheme of https, and the arm64 capability replaces armv7. * feat(native): the UI knows when it runs inside the app Everything the server's UI does differently inside the iOS and Android app lives under src/native and is inert in a browser. Sign-in: SSO and the passkey button go through the system browser (signInThroughBrowser), because identity providers refuse embedded browsers and WebAuthn needs a domain association no build can have for every server. The browser end is the new /native-handoff page: it signs the user in if needed and hands the session over only after an explicit tap, so a link carrying somebody else's challenge cannot pass a session on silently. The verifier is hashed with @noble/hashes because crypto.subtle is missing on the plain-http servers many home networks use. An OIDC-only install no longer bounces to the IdP inside the WebView, and passkey management is hidden in the app. Downloads: the WebView cannot save a blob, so downloadBlob, downloadFile and openFile write to the app cache and open the share sheet. The eight places that built their own download anchor now use downloadBlob, which they should have anyway. The rest: "Change server" on the login page and in the account settings, the splash hides after the first frame, Android's back button walks history before it leaves the app, the status bar follows the scheme, and on iOS the start page is refreshed and every chunk of the build (listed in the new asset-manifest.json) is pulled into WebKit's cache so the app can start without network. * ci(native): build the Android and iOS shells on every change to them Compiles the Swift side on a macOS runner so nobody needs a Mac to know it still builds, and leaves a debug APK on every run to install on a phone. Unsigned: signing and store uploads need secrets fork PRs do not get. * feat(native): offline vector maps in the iOS app In a browser the service worker answers MapLibre from the gl-map-offline cache that glPrefetcher fills for trips marked for offline. The iOS app has no service worker, so nothing read that cache there and the map went blank without network. A trek-offline:// protocol takes the service worker's place. Inside the iOS app the MapLibre style URL is rewritten to it, the handler rewrites every https URL inside the style and its TileJSON the same way, and then serves documents network first and tiles, glyphs and sprites cache first. Outside the iOS app nothing changes. The default OpenFreeMap basemap is covered; Mapbox GL has no protocol hook and stays online-only in the app, as does a custom raster template, whose opaque responses only a service worker can store. * fix(native): keep the iOS offline copy inside the app loadSimulatedRequest went to the server URL without its trailing slash, and Capacitor keeps a navigation in the WebView only when it starts with the bridge's serverURL, slash included. The offline start page would have opened in Safari instead. Also covers the platform helpers and the hand-off API module. * feat(native): the small things that give a WebView away - A short haptic tap on success, warning and error toasts, which is where every save and delete already reports. Info toasts stay silent. - No "‹ › Done" strip above the iOS keyboard. - No Safari preview when a link is long-pressed. - The swipe from the left edge goes back on iOS, through the same history Android's back button walks. * test(mobile): the backup-code download revokes its URL after the shared delay The mobile twin of the AccountTab test still expected the object URL to be revoked in the same tick. Since both screens download through downloadBlob, the revoke happens after its 100 ms grace period. * fix(native): remember the login by default inside the app With the switch off the app got a session cookie, which dies with the app process, so every time the phone unloaded TREK the user had to sign in again. Found while running the Android build in the emulator. * fix(native): no overscroll stretch on Android The UI asks for no overscroll effect with overscroll-behavior: none on html, and Chrome honours it. The Android WebView draws the stretch on its root scroller natively, though, and it scales the whole view, so the top bar and the bottom dock were pulled along with the page. Found in the emulator. * fix(native): Android shows "server not reachable" instead of a blank page Capacitor injects its bridge on Android only into the server's origin once server.url is set, so the local error page it switches to when the server does not load had no bridge. It could neither retry nor change the server and stayed blank. TrekWebViewClient now catches a failed page load (a network error, or a 5xx from a proxy while TREK restarts) and the app starts over on the bundled address screen, where the bridge is present and the screen offers exactly those two choices. The server config no longer carries errorPath. Two traps on the way, both found in the emulator: a restart during launch has to be a fresh task, since recreate() leaves the system splash lying over the new page; and a restart shows no launch splash at all, because the splash plugin cannot take it down again when the page hides it early. * feat(native): TREK's own app icon and launch screen, named just TREK The shells still carried Capacitor's placeholder icon and splash, the blue X on a grid. They now show the white TREK mark on a dark, slightly glassy tile: a soft light from the top left and a sheen over the upper half, in the app's launch colour #09090b. Android 12+ draws its launch screen on the same colour instead of light grey. scripts/generate-app-icons.mjs renders the sources into assets/ from public/icons/icon-white.svg, and `npm run icons:app` turns them into every size both platforms ask for through @capacitor/assets. The Android foreground mark is sized for the adaptive icon's round mask. The home screen label is TREK: the old "TREK - Plan your trips!" was cut off under the icon, and the longer title belongs to the store listings. * fix(native): new lint warnings and the MapLibre protocol type after the dev merge Awaits that sat in loops in the native-auth tests run together, the hand-off hook marks its navigations as ignored, the native tests drop their non-null assertions, and the offline protocol answers with the data type MapLibre 6.15 expects. * fix(native): strict types in the address screen, Prettier on the native-auth e2e suite, file-local exports The address screen's element helper returns the plain element instead of Object.assign's intersection, which strict mode could not represent; the haptics test reads an optional argument as optional; three exports only their own file used are local now. * fix(native): Prettier on the native client files, rate-limit e2e requests in sequence Formats the files the client formatting gate listed, and NATIVE-E2E-005 sends its twenty exchange attempts one after another: all at once they reset the test server's connections. * fix(native): hide passkeys in the app through usePasskeys The flag in useAccountSettings grew the identical destructuring in both account views past the duplication threshold; the shared passkeys hook already decides when its card is hidden, so the app check lives there now. * feat(native): everything the App Store and Google Play submissions need - iOS: microphone usage text for "Take Video", no-export-compliance flag, ExportOptions.plist for App Store Connect uploads, the unused push forwarders gone; CI builds with Xcode 26 and lints the property lists. - Android: version and signing from Gradle properties (unsigned without them), R8 with keep rules for TREK's and Capacitor's reflective classes, no Auto Backup of the session cookie, no external file provider path, template and Firebase leftovers removed, keystores and service accounts ignored, full-size adaptive icon layers with a monochrome layer; CI also builds the release APK. - native-release.yml: signed bundle to a Play testing track and archive to TestFlight, by hand or on a v* tag, behind the store environment. - Version handshake: the server reports nativeApi 1, the app refuses a server below its minimum and tolerates an app older than the offline copy. - Address screen: privacy policy link, "Try the demo" and "What is a TREK server?"; the privacy link also in the app's server settings. Three new native strings in all 27 locales. - Donation links and the notices asking for one are hidden in the app. - Store listings for "TREK Travel Planner" in client/fastlane: texts, review notes with placeholders, privacy and account deletion page drafts, the feature graphic and icon, a length and image check in CI, and a Playwright store project with the scripts that turn its captures into screenshots. - Docs: wiki/Native-Apps.md, README no longer says there is no store app. * fix(native): read a notice button's href without a weak type An action button carries no href, so a parameter typed as only an optional href refused the notice DTO; the button type now names its kind as well. * feat(native): a welcoming onboarding for the address screen The app's own screen now opens on a welcome: the TREK mark, a line about what TREK is, and two clear paths — connect the TREK you already open in the browser, or get TREK Cloud. Both lead to polished screens: the address field with live validation, a shake and haptic on a bad address and a success tick before the server takes over; and a TREK Cloud intro with what it offers and a way in. Screens slide and stagger in, buttons give a tap, and it all respects the safe areas, light and dark, and reduced motion. Self-hosters are unaffected: cloud is its own path, never in the way. New native strings are added across all locales (English placeholders outside en/de, to translate). * feat(native): a plan picker for TREK Cloud, with live prices The Get TREK Cloud path now leads to a plan picker that reads the live plans from the site (/api/plans), so the prices and quotas always match the website. Monthly and yearly in a segmented toggle, the year marked with its saving, each plan a card with its price and what it includes. Subscribe is wired to finish on the web order for now; it becomes an Apple/Google in-app purchase once the store products exist. New strings across all locales (en and de translated). * feat(native): light status bar and a Go key on the address screen The address screen sits on the near-black surface, so set the status bar to draw its clock and icons in light while it is up; the server's own UI takes over the style once it loads. The address field's on-screen return key now reads Go. Both fail quietly where there is no native status bar (web, the simulator). * i18n(native): translate the onboarding into es, fr, it, nl and pl The welcome, TREK Cloud and plan-picker strings were English placeholders in every locale but en and de. The five largest remaining European languages are now translated in full; the others still carry the English text and are a follow-up for native speakers. * feat(native): the in-app TREK Cloud subscription flow After picking a plan, the app now carries the whole purchase itself when the build can take one: choose your address (checked for free as you type, against the same endpoint the website uses), your email, and subscribe. The receipt goes to /api/iap/redeem, and a Setting up your TREK screen waits on the new address and loads it the moment it answers. The purchase sits behind an IapClient seam (src/native/iap.ts): a fake drives the whole flow in development and preview, the native client reports itself unavailable until the store plugin and products exist, and until then the plan picker still finishes on the web, so nothing half-wired faces a customer. New claim and provisioning strings across all locales (en, de and the five largest European languages translated). * i18n(native): translate the app into the remaining 20 languages The onboarding, plan picker, claim and provisioning strings were English placeholders outside en, de and the five largest European languages. They are now translated in full across the other 20 locales (ar, az, br, ca, cs, et, gr, hu, id, ja, ko, ru, sk, sv, th, tr, uk, vi, zh, zh-TW), placeholders and brand kept. The app now speaks every language TREK does. * fix(i18n): add the Hebrew native strings, and correct the LoginPage size baseline The he locale had every domain but native.ts, which broke i18n parity, the shared coverage specs and the client parity test once the native strings existed. Add he/native.ts with all native keys translated. Also correct the LoginPage size baseline to its current line count. * i18n(native): excuse the TREK Cloud brand, mark Email same-as-en, exempt the quota counts The strict i18n checks, which the feature-branch CI does not run, catch three things now that the native strings exist in every locale: TREK Cloud read as an untranslated English phrase (it is a product name, like Vacay and Atlas, so add it to the brand list); Email left identical in Italian, Indonesian and Vietnamese, where it is the local word too (mark same-as-en) and in Greek (give it a Greek term); and the GB and AI-document quota strings carrying {n} without being plural groups (both are figures that never show a singular, like the other unit-symbol counts in NOT_PLURAL). * fix(native): typecheck, lint and knip on the native code; wire he's native bundle The full suite, which the feature-branch CI does not run, catches four things the native work still had: a non-narrowed union in the claim flow (tsc), a helper named useFake that the react-hooks rule read as a hook (eslint), two iap types exported but used only inside the file (knip), and the Hebrew native strings present as a file but never spread into he's merged bundle (the aggregated key parity test). All four fixed. * fix(native): a flat redeem result, so the claim flow typechecks The discriminated union did not narrow under the native-shell tsconfig, so the failure code read as absent on the whole type. Use a flat result with optional instanceUrl and code instead: both are always present on the type, no narrowing needed, and the ok plus instanceUrl guard still routes success from refusal. * style: prettier-format the native and i18n changes The feature-branch CI does not run the formatting check, so the conflict-resolved files (AboutTab, useAccountSettings, useTripExport), the native shell and iap module, and the i18n files touched by the translation scripts were never run through Prettier. Format them all; no behaviour changes. * chore(native): re-trigger CI on the formatted tree --------- Co-authored-by: Maurice <mauriceboe@icloud.com>	2026-11-05 21:09:04 +01:00
Maurice	6ee540d5e4	test(collections): hover the +N of a row that has a category beside its labels	2026-11-05 13:53:57 +01:00
Maurice	99cdcfcd09	test(collections): cover fitting a row's labels and folding the map's label strip	2026-11-05 13:31:25 +01:00
Maurice	82c6a3cd5f	fix(collections): name a hidden label's class without a leading space prettier strips	2026-11-05 13:10:15 +01:00
Maurice	fbafa270c4	fix(collections): fit a row's labels without setting state in an effect, and bring them back when the row grows ... The fitting ran in a layout effect and measured chips the row had already squeezed, so a row that got wider kept its "+N". Every label now stays in the row, the ones without room kept out of sight, and the observer that sees the row change size fits them from each chip's full width. The name takes the width it needs on a wide list and the labels fill the rest.	2026-11-05 13:01:49 +01:00
Maurice	1c54d7d6c1	fix(collections): give place rows two fixed lines and fit labels to the room ... The first fix let a row wrap freely, which on a list beside the map put the status on a line of its own and broke every row differently. A row is now laid out the same way each time: on a list narrower than 760px the name, address and status take the first line and the category and labels one line below; a wider list keeps them on one line. The row shows as many labels as it has room for, category first, and a "+N" chip names the rest in its tooltip, so a wide screen shows every label. Chips that cut a name short say it in full in their tooltip. The label strip over the map hid the labels that did not fit behind a scroll with no scrollbar. It now folds into a "Labels" button that opens them as a list when the bar has no room for all of them, and unfolds again when the room is back. The filter row stays on one line on a desktop, a dropdown at its default keeping only its icon when narrow, and the select bar's actions keep their icons with the words in a tooltip when the bar is too narrow for them.	2026-11-05 12:46:16 +01:00
Maurice	d2c7d83256	fix(collections): keep a place's name readable next to long labels ... A place row was a three-column grid whose last column held the labels, the category and the status, none of which could shrink. With two or three long labels the name got what was left, often one letter or nothing, and the status pill ran out of the card. The row now wraps: the name keeps at least 11rem, and when the labels, category and status do not fit beside it they go to a line of their own under it and wrap there. A label or category too long for its chip ends in an ellipsis instead of being cut mid-letter. Kept tours use the same row and get the same layout. Closes #2981	2026-11-05 12:33:05 +01:00
Maurice	3681db6cd4	fix(collections): the collection map opens on all of its places ... The map framed its first view for the browser window instead of its own box and then skipped the fit, so a list of cafes across Europe opened on northern France. It now fits the places in its own box with room for the label bar and the controls, fits again when the set of places changes, keeps a view the user moved, opens a single place at town level and keeps a list across the date line on its short arc.	2026-10-25 03:12:19 +00:00
Maurice	a440aefd43	feat(assistant): collection list and saved place cards	2026-10-22 21:34:15 +00:00
Maurice	8365d77c1d	feat(client): open views follow member, settings, tag, atlas and journey changes made elsewhere	2026-10-22 21:31:23 +00:00
Maurice	31859651d7	feat(help): rewrite the help center for v5 with a Tours section, new pictures in every language, and fix the tour planner bugs it surfaced ... Every help screen checked against the v5 redesign. Tours is documented for the first time, as a screen of its own with twelve screens under it, and notifications get help of their own. All pictures are taken again on a realistic demo trip, with short loops where a still cannot show the motion. The English is plain and every language is written naturally rather than word for word. The switcher shows two levels at most, a screen's overview lists its sub-screens as cards above its guides, each wiki page is linked once, and the help sidebar is wider. Fixes found along the way: Save to Collection keeps a tour's route, a track dropped on the places column opens the Tours import, tour Share on desktop, the unsaved tour draft lives on the account, a route click no longer adds an end point, Trip places leaves the trip's tours out, Escape closes a stage's day menu, confirms before destructive deletes, DWD warnings sharing one id kept apart, a booking's date moves with it, and smaller fixes across notifications, bookings, the day plan, stays, Atlas, Collections, Vacay and the admin screens.	2026-10-22 22:29:35 +02:00
Maurice	97833412dc	refactor(collections): the invite cards take the async accept and decline as they are	2026-10-12 19:57:48 +00:00
Maurice	8acc035efa	fix(collections): all saved reads its lists four at a time and reloads once per burst of updates ... The "All saved" view read every list in full at the same time, and every collections:* websocket event started that again right away. An agent saving places one by one over MCP sends one event per place, so an open collections tab stacked up full reads of every list on the server. The union now goes through the same batched loader the trip's saved-places picker uses (four lists at a time), reloads asked for while it runs fold into one more pass, and a list or union read that lands after the user switched to something else is dropped instead of painting its places over the new view. The page waits for a run of events to settle before it reloads and keeps the selection on "All saved" like it already did on a single list. Desktop and phone share useCollections, so both get it. Refs #2559	2026-10-12 12:59:44 +02:00
Maurice	e3bf18f9a6	fix(collections): a list invite can be accepted where its notification leads, on phone and desktop ... The invite notification links to /collections/:id, a list the invitee cannot read until they accept. The phone screen had no invite UI at all and showed "Start your first collection", and on desktop the rail with the invites is hidden below 1080px while the empty state had no way to open it. useCollections now recognises a route id that is a pending invite, keeps it out of the route sync and puts it first in the invites it hands out. The phone screen shows the pending invites as cards above the lists, and the desktop body shows them when the person has no lists of their own, or the one invite the route points at. Both reuse the existing invite strings. A route id that is neither a list nor an invite (declined, withdrawn, deleted) now drops back to /collections once the lists are in, instead of leaving the page on a list it cannot show. Refs #2645	2026-10-12 10:44:57 +02:00
Maurice	cf5b5c1245	refactor(collections): share the save to list picker logic between desktop and phone ... useSaveToCollection holds the store driven picker that SaveToCollectionModal and MSaveToCollectionSheet each carried: loading the lists and the membership for a new target, toggling the place in or out of a list, the per list status, marking it visited everywhere and opening the collections page. Both views keep their own markup. The two copies did the same thing, so no option was needed. The load effect now lists the membership query beside the target instead of silencing the exhaustive deps rule; the query is derived from the target alone, so it runs exactly as before.	2026-10-09 15:20:09 +02:00
Maurice	df6a8ba003	refactor(collections): share the saved place detail logic between desktop and phone ... useCollectionPlaceForm reseeds the edit form when a different place opens, fetches a cover photo for a place without one, uploads and removes the custom cover and saves the edits for both the detail sheet and the phone sheet. The detail keeps editing the coordinates and keeps a late photo across an update of the same place; the sheet holds the last place through its exit and drops a late photo once the place object changes, as before.	2026-10-09 15:19:49 +02:00
Maurice	771d4bbf07	refactor(collections): share the list editor logic between desktop and phone ... useListEditor seeds the form from the target, handles the cover upload and the Unsplash search, cleans the links and creates or updates the list for both the dialog and the sheet. The sheet keeps holding the last list through its exit and still hands over a list whose cover upload failed when it closes.	2026-10-09 15:19:49 +02:00
Maurice	634dd411c5	refactor(collections): share the copy to trip picker between desktop and phone ... useTripCopyPicker loads the trips on every opening, filters them by the search, formats the date range and turns the copy result into toasts for both the dialog and the sheet. The dialog keeps its guard against an empty selection.	2026-10-09 15:19:49 +02:00
Maurice	1a4f986cc3	refactor(collections): share the list sharing logic between desktop and phone ... useCollectionSharing holds the invitable users lookup, the roster order, invite, role, cancel, remove and leave for both the share dialog and the share sheet. The dialog keeps one busy member per kind of row action, the sheet one for all.	2026-10-09 15:19:48 +02:00
Maurice	b2fd0ae5aa	refactor(collections): share the add place to list logic between desktop and phone ... useAddPlaceToCollection holds the maps search, the pick and the save that AddPlaceToCollectionModal and MCollAddSheet each carried, with the pure helpers in addPlaceModel. The differences stay as variants. The desktop resets and stays open after an add, sends links and typed coordinates and shows the error's own text. The phone closes, takes coordinates only from the picked hit, ignores a second search or save while one is running and shows the fallback text.	2026-10-09 15:19:41 +02:00
Maurice	8a28f5e22f	refactor(collections): share the bulk save to list logic between desktop and phone ... useSaveTripPlacesToList holds the logic that saves a selection of trip places to a list, which SaveTripPlacesToListModal and MPlacesSaveToCollectionSheet each carried as a copy. The two copies did the same thing, so the hook has no variants.	2026-10-09 15:19:40 +02:00
Maurice	bdaddc44ac	fix(i18n): every count-bearing string is a plural group ... The plural parity check only knows the groups en already declares, so a "{count} ..." string added as a plain key kept one form in every language: Polish read "Usuń 1 spakowanych", Czech "Odstranit 1 hotových" and Greek "1 λεπτά". 44 such en keys become plural groups with their forms in all 27 locales: the collection, packing, day plan and offline banner counts, the relative times, the audit log, the tour and transit minutes, the share and photo hints. Labels like "Notes: {count}" get their forms too, so a language can still inflect them later. The dashboard's hand-rolled activeOne/activeMany pair, unused, becomes one group, dashboard.subtitle.active. i18n-parity now refuses an en string with {count} or {n} that is no plural group. NOT_PLURAL lists the eleven where the number is never a quantity (a day number, a step, a waypoint, the equator multiplier), each with its reason, and an entry that stops matching fails as well. Callers that worked around the engine: - Copy to trip switched between two keys on placeIds.length > 1; collections.copyN now carries the one-place wording as its `one` form, where the language's `one` is the number 1 alone. - The plugin dependency toasts said "addon(s)" and "plugin(s)"; they are groups now and the panels pass the list length as the count. - The dismissed suggestions count went in as a string and the comp days as a formatted string, so no form was picked; both pass numbers.	2026-10-08 13:04:41 +02:00
Maurice	bee500880e	fix(i18n): every language says one file and five files its own way ... Finishes the plural work the previous wip commit started. t() picks a count string's form by the language's own Intl.PluralRules, and every locale now spells out the forms its language reaches with whole numbers, about 160 count strings in all: one, few and many in Russian, Ukrainian and Polish, one and few in Czech and Slovak, five forms in Arabic, one in the others, none in Japanese, Korean, Chinese, Thai, Vietnamese and Indonesian. Each language was translated and then reviewed on its own. English no longer reads "1 files", "1 updates available" or "photo(s)". Count labels shown next to a number now take that number too: the atlas and admin statistics, the trip cards, journey and shared trip pills, packing templates, receipts, storage usage, the Studio export note. A heading that shared its key with a counted label keeps a key of its own (the boarding pass heading, the Bookings tab), so languages that put a noun after a number in the singular keep a plural heading. The plugin hosts chip passed its count through .replace() after t() and never got a form; three toasts sent the count as text. Mail and push texts for shared photos and suppressed storage failures pick their form in code through pluralForm. A whole number sent as text counts too, which is how in-app notification params arrive, and the plural rule follows the language of the strings on screen while another one still loads. The parity check knows which forms each language needs and refuses missing and impossible ones. It also reads keys that contain a colon now: it skipped them, which hid 58 missing plugin permission texts in Catalan and 35 in Vietnamese, both translated. The client parity test covers every language of the registry instead of a hand-kept list of 19, and the placeholder spec lets a form spell its number out only where its category is that one number. Brazilian Portuguese error screens were in Breton, and an Arabic dashboard label held Hebrew text.	2026-10-08 00:01:59 +00:00
Maurice	ba70ad28b8	fix(client): spacing and alignment follow the reading direction ... Arabic runs the app right to left, but margins, paddings, insets, text alignment, borders and corner radii were written for the left side, so icons sat against the wrong edge of their labels, indents and badges pointed the wrong way and amount columns aligned left. They now use the logical forms (ms-, ps-, start-, text-start, marginInlineStart, insetInlineEnd and their CSS equivalents), which are the very same sides in a left to right language. Geometry stays physical on purpose: maps, positions measured from the pointer or a bounding box, time axes, sliders, transforms and print output. Amounts drawn as several spans keep their order in a right to left row, the time picker keeps hours before minutes, and two switches whose thumb slid out of its track in Arabic now move the right way. lint:rtl counts what is still physical per file against a baseline that may only shrink (1512 uses in 370 files before, 319 in 113 now), and CI runs it, so new code reaches for the logical forms.	2026-10-07 22:33:58 +00:00
Maurice	db4337287b	fix: mark deliberately unawaited promises with void (Sonar S9383)	2026-10-01 14:19:52 +02:00
Maurice	8fd46c4c18	feat: quality of life sweep from the feature discussions ... Small requests from the discussions, each built end to end: planner and map (cycling mode, date first headings, clear a day, stay times per day, off-route stops, map lock, compact unplanned markers, pending stays, cable car, transit quick picks), places (location filter, category from OSM, open in maps, geo: link, image from an attachment, enrichment on file import, places near a pin, place name language, Amap first in China), lists and costs (packed counter, inherited sharing, Markdown to-dos, payment notes, bookings CSV, my plan PDF), sharing (unplanned places, travel only, without photos), journey (photo zoom, drafts, photo order, trip suggestion, day jump), atlas (region counter, region bucket list, places per country), vacay half company holidays, studio copy and paste plus the book's own layouts, and RESTORE_FROM_BACKUP for a first start restore.	2026-09-30 23:00:12 +02:00
Maurice	acd003ea67	feat(dialogs): Vacay, Collections, Atlas and Journey in the new dialog look ... Every popup of the four pages moves to the shared dialog frame the trip uses: head band with its icon, the scrolling body, the footer with its actions, and ConfirmDialog for the questions. - Vacay: settings, removing a year (now says so when it fails), the fusion request, inviting a person, a person's colour and sharing the calendar. - Collections: new and edited lists, adding a place, importing a file and a trip's places, sharing, labels and assigning them, copying to a trip, moving or duplicating, saving a trip's places and deleting a list. The stylesheet of the old import view goes. - Atlas: the country popup with the flag in its head, its choices as rows and the wishlist step; Dawarich's Atlas dialog and its accept dialog on the desktop. - Journey: creating a journey, its settings, linking a trip, inviting a contributor, the entry editor (discarding asks in a dialog) and the photo provider picker; the entry card's menu is the shared one. The phone keeps its own sheets: where a dialog is shared with it (Dawarich, the contributor invite, the provider picker) only the desktop frame changes.	2026-09-28 16:52:32 +02:00
Maurice	3901aecbc0	feat(trips): Share and Save to list in the new dialog look ... Share opens on the shared dialog frame: the trip's name and the number of people in the head band, members and guests on the left, the public link and the invite link as two cards on the right. Rows carry their actions as icon buttons named by their tooltips, and removing a member, leaving, handing over the trip or removing a guest asks in the app's own dialog instead of the browser's. The invite link can no longer be created twice by a double click. The phone, which opens the same dialog from its More sheet, keeps the sheet it had; both run on one set of hooks. Save to list has the place's name in the head band, Mark visited as a pill beside it, the lists as rows with a tick, and View at its foot. The public link's hint loses its dash in every language, and the help guides and wiki pages of the Share dialog show the new look.	2026-09-28 13:19:04 +02:00
Maurice	0dd07befa7	feat(planner): bring the plan tab and every trip dialog into the new look ... The Plan tab was the last trip tab still in the old design. It now reads like Bookings, Costs, Lists, Files and Collab, without losing a function: - Day plan: each day is a card with a head band (day tile with weather, stay and rental pills, a "+" menu for place, stay, transport, transit and note), rows with "..." menus, white badges and a white route bar. - Places column: add, search and filters in three rows, a show dropdown, category and rating filters, and a selection bar at the foot. - Place inspector, day details and the stay editor on the shared dialog frame; the place form in the editor look with the name in the head band. - Clicking a booking or transport anywhere on the plan opens the booking detail popup first; Edit leads to the editor. The popup is one host shared with the Bookings and Transports tabs. - Files and Collab dialogs, notes, polls, links and chat moved to the same frame; shared DialogShell and dialogParts hold the building blocks. - The map hover card shows the place photo and follows the theme. Every new and reworded string is translated into all locales, and a few older English leftovers (help center, cost split, import hints) with them. Phone screens keep their own look.	2026-09-27 21:00:19 +02:00
Maurice	a1d6348c5f	revert(collections): a saved place carries no price, website or phone again ... Takes back the editable price, currency, website and phone on collection places from 0df82185b and its review follow-up in a910c2a83. Costs are kept inside a trip only; a collection does not carry them, and #2471 is a feature request rather than a bug. The collection files are back to how they were before, including the dimmed save button from f16698bdb, which only mattered for the price field.	2026-09-23 20:32:41 +02:00
Maurice	a910c2a837	fix: follow-ups from the review of the price, Immich, moving day and import fixes ... Saved place price (#2471) - A price above zero that would be left without a currency is refused with a 400, over REST and through update_collection_place alike. A list has no base currency, so such an amount was read in each viewer's own default currency and went into a trip as the trip's. A price sent alone keeps the stored currency, and a zero price or clearing both fields still goes through. The check sits in the service because the MCP tool spreads the contract's shape, where a refine would never arrive. - An older row that holds an amount without a currency shows it as a bare number instead of in the viewer's own currency. - The Hungarian hint uses the informal register of its file, which is now prettier clean. Immich certificate switch (#2475) - The switch trusts one server. Saving a different URL without sending it turns it off; saving the same URL keeps it as before. The wiki says so. Moving day (#2476) - Google Maps and CoMaps are left out only when there is nothing to hand over. A day with a single stop opens it as a pin again, on the desktop and on the phone, as it did before. - Desktop: a moving day whose flight or train has no stations shows no route tools, since there is nothing left to draw. With stations they stay. - Phone: the drive between two stays on a day without stops or bookings shows once at the top instead of again at the bottom. - The export helpers take the carrier flags as one object instead of two booleans in a row. Import card (#2477) - The success and error marks use the theme tokens. - The e2e test names its upload with a made-up booking number. Tests: COLLECTIONS-SVC-132 and 133, COLLECTIONS-E2E-088, update_collection_place with a price and no currency, FE-COMP-COLEXTRAS-013 (011 adjusted), IMMICH-TLS-010, IMMICH-103 extended, FE-PLANNER-DAYPLAN-222 adjusted and 224, FE-MOB-PLTL-051, FE-MOB-PTLM-047, FE-W4BGT-023 and 024 check the mark colours.	2026-09-23 17:41:26 +02:00
Maurice	0df82185bd	feat(collections): a saved place keeps its price, website and phone, editable like in a trip ... A saved place always had price, currency, website and phone columns. Saving from a trip, the file import and the copy into a trip all carried them, but neither editor showed them and the update contract did not know them, so the validation pipe stripped them from a PATCH and the MCP tool refused them as unknown keys (#2471). - shared: collectionPlaceUpdateRequestSchema takes price (not negative, nullable), currency (three letters, trimmed and upper-cased), website (http or https, as on save) and phone (trimmed, capped at 60 like the file import). The save schema is unchanged. - server: updatePlace writes the four fields inside the existing transaction. update_collection_place spreads the same shape, so REST and MCP take and refuse the same values; its description now names the price and asks for the currency with it. - client: the desktop detail sheet and the phone sheet edit price with a currency picker, website and phone, and show them in read mode (price only above zero, phone as a call link, website as a link chip through safeHttpUrl). Both shells share one hook, useCollectionPlaceExtras, which sends only the fields the user changed and always pairs a price with its currency, since a list has no base currency. An amount that does not parse marks the field and holds the save. - i18n: collections.price, collections.priceHint and collections.phone in all 23 locales; the website label reuses places.formWebsite. - wiki: Collections and MCP-Addon-Tools name the new fields. Tests: schema spec, COLLECTIONS-SVC-128 to 131, controller pipe parity, update_collection_place with the new fields, COLLECTIONS-E2E-085 to 087, FE-COMP-COLEXTRAS-001 to 012, FE-COMP-COLDETAIL-049 to 054 and FE-MOB-CPLSH-042 to 046.	2026-09-23 17:41:26 +02:00
Maurice	d803efd39d	feat(collections): import a file into a list that already exists ... The import dialog always made a new list. It now asks where the places go: a new list, as before and still the default, or a list that is already there. The picker offers the lists the person may edit, which is their own plus a shared one where they are an editor or an admin, and starts on the list they have open. Adding to a list only ever adds. A place the list already holds is left exactly as it is, with its status, notes, rating and labels, and counted as already there in what the import reports; it is recognised the way a single save recognises one, by provider id, then name, then position. The list keeps its own name, colour, icon and description whatever the file says, a label the file brings is created only when the list has none of that name, and new places are appended after the ones already there so a manual order survives. The route is POST /api/addons/collections/:id/import, 200 because it adds to a list rather than making one, and both imports now write their places through the same helper.	2026-09-19 23:12:25 +02:00
Maurice	80bb06c84f	feat(collections): export and import a list as GPX ... A list could leave the instance as a TREK file, which only another TREK reads. Export now asks for a format, and GPX is the second one: the places as waypoints, for OsmAnd, Organic Maps, a Garmin or gpx.studio. Import takes a GPX in the same dialog as a list file. Asked for in discussion #2301. The GPX is written from the very list file the JSON export returns, so what may leave the instance is still decided in one place. Name, description and address, notes, website and category go into GPX's own elements, where every app shows them. Labels, status, phone and the rest travel in a TREK extension namespace, so a GPX made by TREK comes back as the same list. A place without coordinates cannot be a waypoint; it is left out and the export says how many were. A GPX is read on the server, sent as text, with the XML library the trip importer already uses. A document with a DOCTYPE is refused before parsing, which closes both external entities and entity expansion. Size is capped like the list file, and the element count is capped before a tree is built. The reader only turns the GPX into a list file: the browser previews it and imports it through the existing route, so one contract, one transaction and one skipped counter cover both formats. Waypoints and named route points become places; tracks and unnamed route points are counted in the preview and not imported. The two list-file routes get a body ceiling of twice the file limit. The global 100 kB cap refused most real favourites files, and it already refused list files well under the megabyte the contract allows.	2026-09-19 21:01:45 +02:00
Maurice	40f8912937	fix(collections): put the cover camera beside the close button ... The custom image control on a saved place's cover sat in the top left corner, on top of the category chip, and hid half of it. It also looked like nothing else on the cover: a square dark button next to a round translucent close button. The camera and the remove image button now sit in the top right corner next to the close button, camera directly left of the X, remove further left when there is a custom image, all three in the close button's round translucent look with its hover, phone size and focus ring. The phone sheet had the same overlap and gets the same row. The category chip and the controls share one header, so neither can run under the other: the controls hold the end and never shrink, and the chip ellipsizes a long category instead of sliding under the buttons in the narrow docked detail. On the phone the header is in flow, so a place without a category starts its name below the buttons. Picker, tooltip, labels, the spinner while an upload runs and the removal control behave as before. The trip planner inspector keeps its avatar overlay; it never had the overlap.	2026-09-19 19:24:37 +02:00
Maurice	27ce4df6f5	style(collections): the place panel as things on their own ground ... The labels tried the cover photo and lost: a blue chip on a blue sky is simply not there, whatever shadow it carries. They sit beside the rating now, both as badges on one row — two answers about the place, side by side, each legible. The note takes the full width on a ground of its own. Loose in the column it read as another paragraph of the panel rather than as something somebody wrote about this place.	2026-09-13 17:02:17 +02:00
Maurice	1a95157b3a	feat(collections): say what a place is without having to click it ... Asked for in the feedback: a wall of round photos, and no way to tell which is which. "Name and displaying any custom rating would be very beneficial to quickly seeing what is around you that is of interest." The collections map had hover switched off. The trip map has told you what a marker is all along, so it is the same card, now shared instead of written a third time — it already existed twice, once per renderer, and the two had drifted in how they resolved the category icon. The card gains a rating, and so does the marker itself: an amber disc on the corner where a trip's day numbers sit. The two never collide, because a numbered stop is one already planned into a day and this answers the question asked before that. Nothing is drawn for an unrated place, which is most of them. Also from this round: the place panel's labels move up beside the name, where a label belongs — read three rows down they looked like a property of the rating above them — and the rating gets a ground of its own so a line of stars stops reading as another row of text.	2026-09-13 16:49:20 +02:00
Maurice	8fc788fb37	style(collections): the place footer is one row of things you do ... Getting directions sat up by the address, in a pill of its own, while editing and copying sat in the footer as square buttons. All three are things you do WITH the place, so they belong together and should look like one set. Navigation moves down beside them, and the footer takes the shape the navigation button already had.	2026-09-13 16:35:31 +02:00
Maurice	2c06c9904b	feat(collections): a list as a file, so it can leave the instance (#2198) ... Sharing a list works between people on the same TREK. This is the other case: giving one to somebody who runs their own, or keeping a copy. Export sits beside Edit and Share in the list header and downloads the open list; Import sits beside New list in the rail, reads a file, shows what is in it and makes a new list of it. Desktop only, which the route already decides. What travels is what somebody wrote down: the list's name, colour and description, its labels, and each place with its address, coordinates, notes, status, contact details, category name and labels. A file is dull JSON on purpose, so it can be read and edited by a person. What does not travel is everything that only means something on the instance it came from. Ids of every kind, since the receiver issues its own and a category crosses over by name. Star ratings and members, because a rating is an opinion somebody gave the people on that list. Provenance into trips, which points at rows the receiver cannot see. And an image path under /uploads, which resolves on the sender's server: only an absolute https URL survives. A file is a stranger's JSON and is read as one. It is parsed in the browser that chose it and never uploaded; the parsed list goes through the same contract on both sides; and a link that is not http(s) arrives as nothing rather than as an anchor. Strict where it must refuse, forgiving where it can drop: a file that does not say what it is never reaches the importer, while one unreadable place inside it is skipped and counted, and one bad field on a good place costs that field alone. An import is always a new list. Importing into an existing one would mean deciding what happens to a place that is already there, and every answer to that is a merge nobody asked for.	2026-09-11 14:58:34 +02:00
Maurice	9fa0ceaf49	feat(places): add a place straight into the day that is open ... The places pool sits one click away from the plan, and a place you already know belongs to today had to go through the day picker afterwards to get there. With a day open, the add button splits: the left half still opens an empty form, the right half opens one that assigns the place to that day on save. The plumbing was already there. placeFormDayId has assigned a freshly created place to a day since #1998; nothing in the places rail ever set it. The main label shortens to "New place" while the split is out, so both buttons fit side by side in the rail without either one truncating. The second button stays mounted and collapsed rather than unmounted, so it has something to animate out of: width, padding and opacity over 180ms, and nothing at all under prefers-reduced-motion. Collapsed it is also out of the tab order and hidden from screen readers, because a zero-width button is still focusable otherwise. Both columns of the place form are 320px now. Two panels of different widths flanking one form read as a mistake rather than as a hierarchy, and neither of them is the more important one.	2026-09-08 20:41:57 +02:00
Maurice	900e4806ad	fix(places): centre the empty states, and give the details column one too ... Five states, one shape. EmptyState grows a `fill` option: the stack already centres what it holds, but with no height of its own there was nothing to centre inside, so every one of them sat pinned under the header of its column. Optically centred rather than geometrically. The extra room goes underneath, which puts the mascot slightly above the middle: in a column you can scroll, dead centre reads as having fallen to the bottom the moment the list is short. The details column's own placeholder joins them, with the idle look rather than the sad one, because nothing being picked yet is a state and not a fault. Its line is shortened to fit on one: "Pick a result to see more", in all 23 languages. The corridor panel, the saved-places list and the place details all dropped `compact`, so the five now read at the same size as the road trip rail.	2026-09-08 20:41:57 +02:00
Maurice	4a88dbcbcf	fix(places): say where a result came from, and stop asking questions in the form ... Six changes to the place picker and the card behind it, all of them about a panel saying less and meaning more. The TREK place index has no switch in the admin panel any more. It decides whether a search leaves the instance at all, which is a property of the deployment rather than a taste: an operator pins TREK_PLACES_ENABLED=false in their compose file, and it cannot be turned off from a browser by whoever holds an admin account that day. The switch never shipped, so nothing to migrate. The standing "Using OpenStreetMap" notice above the search box is gone. It was a sentence about configuration in the middle of a form about a place, and it answered a question nobody asked while leaving the real one open. Each result now carries a small mark instead: TREK, OpenStreetMap or Google. It sits on the row rather than above the list, because a list can be two indexes interleaved and a heading could only name one of them. The saved-places filters open across the full width of the row. Two of them sit side by side, only one can be open at a time, and list names were being cut at about ten characters for no reason. Three empty states use the mascot the rest of TREK uses. The place details panel no longer tells the reader to go and ask an administrator for a Google key, the saved-places list and the road trip rail no longer explain themselves in two lines of grey text. That needed one new mood, `sad`: `sleepy` reads as falling asleep, which is a different thing from finding nothing. The Kind of stop field is out of the place form. It is a road trip concept, and the road trip view already sets it from the stop's own number, where the choice is next to what it changes.	2026-09-08 20:41:57 +02:00
Maurice	293dc9e1f1	fix(ui): defuse the press-scale click trap on three more composite buttons (#2158) ... Same trap the task-list fix hardened: the press animation shrinks the container mid-click and the release lands next to the target. The collections rows, the journey gallery tiles and the shared vacay calendar cards carry the established no-press attribute now.	2026-09-02 21:06:51 +02:00
Maurice	b401da2264	fix(maps): default the Leaflet basemap to OpenFreeMap ... CARTO started stamping "API KEY REQUIRED" across every keyless basemap tile on 26.08.2026. #2060 added a key field as the immediate answer, but it leaves a self-hosted instance needing an email exchange with CARTO before its maps look right, and every default in the client still pointed at CARTO. Default to OpenFreeMap Positron instead: no key, no account, no request limit, commercial use allowed, attribution required. OpenFreeMap serves vector tiles only, so the Leaflet basemap is a MapLibre style document rather than an XYZ template. maplibre-gl-leaflet hangs a GL canvas into Leaflet's own tile pane, which leaves everything above it alone - markers, GeoJSON, clusters, plugin layers, the custom panes, and the click handling, since Leaflet's CSS already puts pointer-events:none on that layer. maplibre-gl still arrives only through a dynamic import, so no chunk that draws a map grows by a megabyte. Switched: the trip planner, the MapView fallback every preview goes through, the journey map, collections, the atlas, the shared trip page and the offline tile prefetch. OpenFreeMap Positron and Bright join the tile presets in settings, the admin defaults and both mobile screens. A CARTO template that is already saved keeps working when a key backs it - that stays a supported choice. Without a key it is not drawn at all: resolveTileUrl falls back to the default rather than to a watermark, so an instance that upgrades with one in its settings sees the new basemap immediately and needs no migration. The stored value is left as it is, so the Map settings tab still shows what was chosen and the warning underneath it explains why - one sentence appended, in all 23 locales. OpenFreeMap asks for a credit of its own; OpenStreetMap alone under its tiles is wrong and a licence problem. attributionForTile() derives it from the URL rather than from a flag at each call site, and the shared trip map, which carried no attribution at all, now gets one. Offline maps keep working and get cheaper. A vector style is four things instead of one, so sync/glPrefetcher.ts walks the style document, its sprite, the Latin glyph ranges of each font stack it uses, the TileJSON - the planet path is versioned, so guessing it answers 200 with an empty body - and then the .pbf tiles. Over the Berlin bounding box TREK computes, raster z10-16 is 2237 requests and 34.6 MB and gives up above z16; vector z10-14 is 177 requests and 32.1 MB and stays sharp above that, because MapLibre scales the z14 tile rather than asking for another. The Workbox rule for tiles.openfreemap.org moves to CacheFirst and shares the prefetcher's cache, so browsing tops a downloaded region up instead of filling a second copy beside it - a versioned tile path can never be stale. Clearing offline maps clears it too. The atlas loses its second raster layer. It existed to warm the HTTP cache of neighbouring zoom levels, which a vector basemap does not need; a second one would only cost a second WebGL context. OpenFreeMap has no label-free style, so its labels are switched off on the live map instead - they are all symbol layers, while borders and coastlines are line and fill - re-armed on style.load so a theme switch keeps them off. Theme changes call setStyle in place rather than rebuilding the layer: a swap per toggle would leak a WebGL context, and browsers cap those in the low teens.	2026-08-29 00:51:43 +02:00
Maurice	1f66ef1d32	fix(maps): let users and admins enter a CARTO API key (#2060) ... CARTO stamps an "API KEY REQUIRED" watermark onto every basemap tile fetched without a key since 26.08.2026, and both CartoDB presets plus the built-in fallback are CARTO. The key is free and needs no account, so add it as a setting rather than dropping the provider. carto_api_key sits next to mapbox_access_token: per user in Settings/Map, instance-wide under Admin/User Defaults, encrypted at rest, injected from CARTO_API_KEY on managed instances. Unlike Mapbox it never switches the map provider, since a raster key says nothing about the renderer. The key is appended as ?key= at render time instead of being stored in the template, so a saved URL stays portable and survives a rotation. That is also what reaches the four maps that pinned CARTO and ignored the user's tile setting: atlas, collections, the public trip share and the public journey. The two share pages read it from their token-gated payload, the same way baseCurrency already travels. Also lifts the release notice above page chrome. Its overlay sat at z-index 50, under the Vacay mode toolbar at 61, so the dialog was neither on top nor modal. Adds a six-step layer scale to index.css and moves the three notice shells onto it. Closes #2054 Closes #2052	2026-08-27 12:06:55 +02:00
Maurice	1ad2e92142	fix: make the app keyboard-reachable, and close four DoS-able patterns ... The bulk of what SonarQube still had open on the reliability side, read site by site rather than swept. Two clusters are worth calling out because they are defects, not lint. **Four regexes could be made to hang the process.** The worst is `/.+@.+\..+/` in the forgot-password path: three unbounded `.+` that all overlap, unanchored, on an endpoint that needs no login and whose schema is a bare z.string() under a 100kb body cap. A thousand '@' characters had not finished after 100 seconds — one request pins the event loop, and Node has one. EMAIL_REGEX in auth.helpers is the same shape on register and profile update (310ms for 8kb). The two tag strippers over an uploaded KML description and over Commons metadata took 0.52s on a 16k run of '<'. Each rewrite was proven equivalent by brute force against the original — millions of strings for the coordinate patterns, 671,876 for the tag stripper — because a subtly different regex on a parsing path is worse than the finding. `<[^>]+>` could not be fixed in the pattern: `[^>]` matches `<` too, so the only unambiguous form changes what happens to malformed markup. It is now a scan in common/stripHtmlTags.ts, quirks included — `<>` is left alone, `<a<b>` is one tag — with the equivalence pinned by a test that compares against the old regex over every string up to length six. **And roughly 500 places could only be reached with a mouse.** Clickable divs became real buttons where the markup allowed (52 of them), took role + tabIndex + Enter/Space where they had to stay divs, and modal backdrops took role="presentation" — the honest role, since a backdrop is a mouse shortcut for a Cancel control that is already in the tab order, and making it a button plants a nameless full-screen tab stop around its own contents. Alongside those: `.sort()` calls that now say the order they always had, `{n && <X/>}` guards that rendered a literal "0" for a zero-byte file and for a place at latitude 0, an optimistic budget write that stored a boolean where the contract and both transports use 0/1, and the Number statics. sonar-project.properties documents the six that were deliberately left: two wiki patterns with no overlapping quantifier pair whose "fix" would stop parsing `[see [1]](url)`, four tar header fields bounded at 12-155 bytes by the format, two djb2 hashes where the 32-bit wrap is the algorithm, two `| 0` that are also coercing undefined to 0 on a path where the API sends no user_id, and the MCP session maps Sonar reads as empty because they are filled from another module.	2026-08-25 19:26:38 +02:00
Maurice	2c2d008dc2	fix: clear every open Sonar security issue, and half the reliability ones (#2037) ... * fix(security): mint idempotency keys properly, and resolve the extractor by path Three findings out of a sweep of every open Sonar security issue. The other 49 turned out to be false positives and are documented in sonar-project.properties rather than changed — each entry scoped to a file, never a whole rule, so a future Math.random() on an auth path still fails. The idempotency key is the one that can lose data. Both producers fell back to Math.random when crypto.randomUUID was missing, and randomUUID needs a secure context — TREK's own quickstart is http://localhost:3000 and LAN installs run on http://192.168.x.x, so on the deployments the README documents the fallback is what actually runs. The axios one was `Math.random().toString(36).slice(2)`, which is not length-stable: 0.5 yields a single character and 0 yields the empty string, which the interceptor reads as "no key" and skips deduplication for entirely. Two writes sharing a key collapse into one — the second gets the first one's cached response and the edit is gone with no error anywhere. Both now come from utils/randomId, which has the getRandomValues rung that works in insecure contexts too. The extractor probe stored the bare binary name, so every extraction re-resolved it through whatever PATH held at that moment. The official image sets KITINERARY_EXTRACTOR_PATH and never reaches that branch, but a bare-metal install without it ran an unqualified name from a PATH it does not control. It now walks the search path itself and keeps the absolute path of the file it verified; execFileSync also drops the /bin/sh hop the old probe needed. PATH comes through app-config because process.env is walled off in src/. * fix: four tests and sorts that were not doing what they claimed Sonar reported 43 high-impact reliability issues. Reading all of them, four are real; the rest are cosmetic or would be made worse by the suggested change. budget.test.ts hand-built `paid: true`, but both emitters send `paid: body.paid ? 1 : 0` and the handler stores the value verbatim — the test asserted a payload the server never sends. The line below it already used a number. admin.controller.test.ts had a `.resolves` assertion with no await. The promise was dropped, so that line could not fail the test. The two to-do category lists sorted with a bare .sort(), which is byte order: every accented name files behind the whole ASCII range, so in a German trip "Übernachtung" lands after "Zelt". TREK ships 23 locales, so this is real data. One side effect worth knowing: katColor picks a category's dot colour by its index, so re-sorting can move which category shows which colour — it already moves whenever a category is added, and the colour carries no meaning. Deliberately not changed: the two `| 0` truncations (Math.trunc is not equivalent — `| 0` wraps at 32 bits and these carry millisecond timestamps), the two .map() callbacks whose second parameter is declared and used, and the sha1 in thumbnail.service (its own comment says a swap would orphan every existing thumbnail). * refactor: give every button a type, and prefer the Number statics Two mechanical sweeps, no behaviour change intended in either. A <button> with no type attribute is type="submit" per the HTML spec. Outside a form that does nothing today, but it turns into a surprise the moment the markup is wrapped in one, which is what Sonar's S9011 is warning about. 870 buttons get an explicit type="button". Two things were left alone on purpose: buttons that take a {...spread}, because the spread may carry a type and the merge order decides which wins, and anything inside a <form> — there the answer is a judgement call, and checking all eleven form files found every real submit button already carrying type="submit". The Number sweep covers only the three globals that are exactly equivalent to their Number twin: parseInt, parseFloat and NaN. isNaN is NOT in it — the global coerces its argument, so isNaN('abc') is true where Number.isNaN('abc') is false, and renaming it would change what the code does. It reaches server and plugin-sdk as well as the client; both copies of egress-policy.ts got the identical edit, so the mirror the SDK's parity test guards stays intact.	2026-08-25 15:22:38 +02:00
Maurice	19745b7b0d	fix(studio): keep "Keep mine" from throwing the document away ... After a save conflict, Keep mine set the version and unblocked writes but never re-queued the local document, and write() had already cleared the queue before the request. So if the user picked Keep mine and then simply closed the editor without typing anything else, saveNow() found nothing pending and did nothing: their afternoon of edits existed only in memory, the indicator said idle, and the server kept the other version. The exact outcome the conflict dialog promises to prevent. Ctrl+Z was intercepted while typing in a text field too. Studio commits text on blur, so mid-edit the typing is not in the undo history yet: the browser's own text undo was suppressed and a previous layout change was undone underneath the open editor instead. Reads as random data loss. Also: delete no longer removes locked elements, the auto-layout no longer freezes an empty GPS path when tracks resolve after the one-shot build, the back-cover tally cannot print "0 places", the map fetch aborts when Studio closes, and a double Enter in the list-name field stops creating two lists. The page-pattern gate had quietly stopped covering anything: the Desktop-shim refactor moved every real container out of the default export the checker reads, and its regex missed useRef<T>(null) anyway. Widened on both counts, and the state it immediately found moved into the hooks.	2026-08-23 11:59:12 +02:00
Maurice	9dd0a851ca	fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923) ... * fix(mcp): accept per-leg times on create_transport and update_transport metadata was pinned to Record<string, string>, so a legs array could not get through and a multi-leg flight built over MCP lost every intermediate time. The booking ended up with correct endpoints and no legs, which every reader then treats as a single segment. legs is now a real, typed parameter with its contract in @trek/shared, shaped exactly the way the planner form and the importers write metadata.legs. The folding checks what the readers depend on: one leg fewer than endpoints (the AirTrail dedupe builds its signatures on that), day ids that belong to the trip, airport codes that agree with their endpoint, and the times, where a stopover endpoint carries the departure and the last one the arrival. metadata keeps its type and its replace semantics. Segments smuggled through metadata.legs as a JSON string used to be stored and then ignored by everything that read them; they are refused now and point at the legs parameter instead. Closes #1914 * fix(atlas): refuse a bucket list entry that is already on the list Nothing gave a bucket entry an identity, so the same country could be added as often as it was clicked. A wish is now identified by name, country, target date and, where it has them, coordinates. A different target date is a different wish and still lands, which is what the report asked for; two real places sharing a name stay separate because their coordinates differ. Empty string and NULL are normalised on both sides of the comparison, otherwise the dateless case, which is the one that was reported, would slip through. Deliberately no unique index and no migration. better-sqlite3 is synchronous and the server is a single process, so the race an index would guard against cannot happen here, and an index would have needed a destructive dedupe of existing rows first. create_bucket_list_item had no target_date parameter at all, so over MCP the allowed "same place, other date" case was unreachable. It takes one now. The plugin RPC reports the duplicate as bad params instead of letting it surface as an internal error. Closes #1898 * fix(settings): keep a free-form LLM endpoint in admin hands Any account could name the address the server calls, and the guard in front of it deliberately allows loopback and LAN so a self-hosted Ollama works. That is a reasonable trade for whoever runs the instance, because the network is theirs. It is not one for an arbitrary account, which could aim a request from inside that network at a target only it chose and read how the target answered. A free base URL, and the local provider that is one by another name, now come only from an admin controlled source: the addon config, the instance-wide defaults, or an admin's own settings. OpenAI and Anthropic stay available to everyone, because they go to a fixed address with the user's own key. The resolver is where this is enforced, since it is the single point both the booking import and the plugin host pass through, and the only one that also covers values already sitting in the database. The write path refuses as well, so nothing is stored that would never be read. The hint text promised something users no longer have, so it changed with it. Closes #1772 * fix(calendar): span a date-only booking to its end date A DATE event without DTEND is exactly one day per RFC 5545, so a multi-day booking that carries an end date still collapsed onto its first day. It gets an exclusive DTEND now, built the same way the stay branch already builds one. A booking without an end date serialises byte for byte as before. While in here: the stays query joins reservations on the accommodation, and two bookings pointed at the same stay fanned it out into two events sharing one UID. Duplicate UIDs in a feed are undefined behaviour and calendar clients pick one at random. The same "at most one booking per stay" assumption sat in the accommodations service, where it was worse than cosmetic: accommodation_id carries no foreign key, so deleting a stay took only the first booking and left the second pointing at something that no longer existed. Both the sync and the delete walk all of them now. The callers keep reading linkedReservationId; the list is additional. Refs #1869 * fix(vacay): say that the region is required, because it is The placeholder called the region optional while the add button stayed disabled until one was picked. The wording predates multiple calendars per plan, which is what introduced the gate. Only the value of the existing key changed, in all locales, so the key set stays identical. Two things the same screen got wrong were in the way of a clean answer: The button was clickable while the region list was still loading, which put the user in exactly the state the wording describes, and it is the state the report was filed from. It waits for the list now. Changing the country on an existing calendar kept the previous country's regions on screen, so a German region could be picked for the Netherlands. The list is cleared with the country, which only works in combination with the loading gate: without it, the empty list would happen to enable the button instead. Closes #1813 * fix(collections): let a saved place's address be corrected The edit form offered name, category and labels, and the address only on the way in. The cause was not the form: the update contract never declared address, so the validation pipe stripped it and the UPDATE had no column for it. Coordinates were pulled through for #1435 and the address was missed. It travels the whole chain now, contract to service to both forms. No migration, the column has always been there. The mobile add sheet had no address input at all, showing whatever the search result carried as read-only, so editing would have worked while creating still would not. It has one. The MCP tool description had drifted further than the address, never having mentioned the coordinates either. Both are in it now. Closes #1870 * fix(collections): keep the place search usable after the first save The add dialog stays open on purpose so several places can be added in a row, but after a save it gave no way back into the search. A search with no results was silent, with no empty state and no toast, so typing another name and pressing enter looked like nothing happened. The reporter described both halves and it is the silent search that matches "nothing happens" most closely. There is an empty state now, using a key that already existed in every locale and was unused. The search row is sticky inside the dialog body, so it stays reachable after the save instead of sitting above the scroll position. Also fixed while in here: refreshing the collection after each add reset the select mode, the selection and the label filter. In the very flow this dialog is built for, the user quietly lost all three. Closes #1921 * fix(vacay): make the phone year grid and the dock button do what they look like Two separate faults met on this screen. Tapping a day in the year grid did nothing unless the edit mode was already on, and the only way into it was a floating button that looks exactly like the one the dock draws in the same spot. A tap now opens that month in the editor, where the cells are big enough to hit. At 390px the grid cells are around 21px, which is too small to be mutating data with in the first place. The dock's plus was not wired for this route, so it fell through to creating a trip on the dashboard. Two different actions were stacked in one place, and the wrong one was on top whenever the screen had not painted yet, which includes the time its chunk is still loading. The dock leaves the slot to the screen now, and holds the geometry so the tab groups stay symmetric. Closes #1811 * fix(budget): settle in whole cents so balances stop drifting The report is a balance that moves on its own, with nothing added, edited or removed, on a trip where everything is in euro. Two mechanisms were behind it and both are real. The display currency is a fourth value, a per-user setting, so "everything is in euro" never covered it. Each balance was converted and rounded on its own, and the set no longer summed to zero: at 0.855 and 0.9312 it came out one cent over, at 0.94 it came out even. That cent appears and disappears with the six hour rate cache alone, which is exactly the symptom. The flows were rounded separately from the balances, so the two never had to agree. And a receipt line nobody was ticked for counted toward the total, and therefore toward the payer's credit, while landing in no share. That difference is permanent, and the client sent it that way. The settlement converts once, at the edge, and does integer arithmetic after that. Equal splits distribute the credited cents by largest remainder rather than the entered total, so credits and debits of one expense cancel exactly even in a foreign currency. Display conversion goes through the same largest-remainder allocation, so the sum survives it. With that, the 0.01 epsilon can go. It could never create a cent, but it stranded them: a one cent balance was filtered out of the flows while staying visible in the list, which is the "settle up offers nothing" half of the report. Closes #1382 * fix(journey): reach the book export and the suggestion toggle on a phone Below 1024px the hero card is dropped, and it held the only way to either action. The floating bar that replaces it was never given them. It has them now, and the hero is unmounted rather than hidden, so there is no second invisible copy of the same controls in the document. The bar's own buttons moved onto the appearance tokens while they were being touched. The phone screen never had either action at all and now carries both. The book itself was hardwired to English, cover and dates included, while the keys for it had been sitting in every locale unused. It takes the page's translator and locale, sets the document language, and prints mood and weather, which were on screen but never in the book. Closes #1848 * fix(journey): offer the connected photo providers in the phone entry editor The desktop editor grew an external photo source in #1632; the phone editor that came out of the mobile rewrite never did, so editing an entry on a phone had no way to Immich or Synology. It mirrors the desktop mechanics, including the part that is easy to miss: a save that creates the entry and then fails on the photos keeps the sheet open, and without remembering what was just created the retry creates a second entry. The sheet no longer kicks off its own addon load. The list is loaded once on boot and this only reacts to it; a second load races the other consumers and overwrites the store when it lands. Closes #1808 * fix(mobile): let the document scroll so Safari can collapse its URL bar iOS Safari only shrinks its address bar when the document scrolls, and TREK's never did: the root was locked and the mobile shell put a scroll container inside it. On the bottom tab layout that costs about a sixth of the viewport, permanently. Below 768px the document is the scroller again and the full-bleed screens measure their own height instead of leaning on the shell. That makes the body scroll locks real for the first time on a phone, and they were not ready for it. Three of them reset the overflow unconditionally, one of those on every run of its effect rather than on unmount, so a system notice could hand the page back while a sheet was still open. They all go through one reference counted lock now, which is the part that had to land first. Worth knowing for the issue: this reaches the flow screens. The trip planner, the journal, the atlas and the vacay screen keep their own full-height scrollers and still will not collapse the bar. Closes #1809 * fix(mobile): keep the screen gradient visible behind the translucent cards The gradient layer introduced with the scroll change sat at z-index -10. A negative layer paints above the canvas but below the backgrounds of ordinary blocks, and body carries an opaque one, so the gradient was hidden behind it. The mobile cards are translucent and take their depth from what is behind them, so every surface ended up compositing against a single flat colour and the whole phone UI read as one tone. The layer is positioned at z-index 0 now and the content above it at 10, which puts both over body's background. Same visual as before the scroll change, and the shell still owns no scroll container. * test(reservations): teach the accommodation delete stub about the id lists The RPC walks every linked booking since the delete stopped stopping at the first one. The stub still answered with the two singular fields, so the loop had nothing to iterate and the cascade events never fired. * fix(settings): move the free-form LLM endpoint out of user settings entirely Hiding it from non-admins closed the hole, but it left the option sitting in the admin's own personal settings, which is not what was asked for and not where it belongs: an instance has exactly one address it calls out to, and there was a second, invisible place to set it. The provider list is now the two hosted ones for everybody, the endpoint field is gone, and the resolver takes the address from the admin-controlled instance defaults for every caller including an admin. It no longer reads the users table at all. The write path refuses the keys for everyone, so nothing can be stored that would never be read. The endpoint is configured on the addon in the admin settings, which already carries provider, model, base URL and key, plus the Ollama model list. Nothing is lost, it just has one home now. Behaviour change worth a release note: an admin who set a personal Ollama endpoint has to move it to the addon config. A non-admin was already in that position after the previous commit. Refs #1772 * fix(journey): make the book preview usable on a phone The preview document carried no viewport, so a phone laid it out at its default 980px while the page is A4 landscape and about 1123px wide. It spilled out of the frame, which reads as being zoomed far in. Declaring the real width lets the browser scale the page to fit. Printing is unaffected, it goes by @page. The preview chrome had the same problem in miniature: a title and two labels on one row, sized inline, which does not fit a phone and fits translated labels even less. It moved to a stylesheet, and below 640px the card goes full-bleed, the decorative title steps aside and the two actions share the width. Refs #1848 * fix(mobile): stop the shell trapping the screens' own overlays Lifting the background layer into the positioned range meant the content wrapper had to be positioned too, and a positioned wrapper with a z-index is a stacking context. Every fixed overlay a screen renders inside it got clamped to that level: the vacay view/edit FAB sits at z-50 precisely so it beats the dock at z-40, and it disappeared behind it. The layer goes back to a negative z-index and the wrapper back to no positioning at all. What it needed in the first place was for body to stop painting over it, which is one line in the phone media block rather than a new stacking context. * fix(mobile): let the phone background override actually win A media query adds no specificity, so the themed body rule further down the file kept winning on source order and painted over the shell's background layer. The override is on html body now. The gradient was back to being invisible, which is the flat single-tone phone UI again. * fix(vacay): draw today's ring around the day instead of replacing it On the phone, today short-circuited the day-cell matrix and returned a ring on an empty cell. A vacation day or a company holiday logged for today was stored and counted in the totals, but the cell showed nothing, so it read as if the tap had not taken. Today is an annotation now, layered like the school band and the shared-calendar rings, which is how the desktop month card has always treated it. The strong ink stays only where the cell has no fill of its own, since --m-ink is light in dark mode and would disappear on a pastel. * fix(map): stop serving a stale GL style document from the service worker The Workbox rule for Mapbox matched every URL under api.mapbox.com, and the style document lives there too. Under StaleWhileRevalidate the map was built from the previous revision on every load, with the refresh landing one load too late, so a style republished in Studio with different label languages kept rendering the old ones. The network tab showed a 200 throughout, because the service worker's own answer is a real 200, which is why this looked like the app rewriting text-field at runtime. The style now has its own rule ahead of the tile rules, on NetworkFirst so it is current whenever the network is, and still cached so the map opens offline. Its own small cache too: sharing an LRU with three thousand tiles made the staleness come and go at random. OpenFreeMap styles had the same problem and are covered by the same rule. Closes #1924	2026-08-13 14:06:35 +02:00