85 Commits

Author	SHA1	Message	Date
Maurice	736599a89b	feat(journey): TREK Studio — a photo book designer for Journey (#1973) ... * fix(photos): serve local photos root-relative so a dotted install path works res.sendFile(absolutePath) resolves against the rewritten req.url under the Nest ExpressAdapter and answers a spurious 404 even though the file is there — the same trap files-download.controller.ts:60 and plugin-frame.controller.ts:74 already work around with an explicit { root } + basename. The photo resolver never got that treatment, so every thumbnail and original 404s on any install whose uploads path contains a dot segment (~/.local/share/trek and friends). The public journey asset route had it too, which took shared journeys with it. The guards above each call already confine the path to the uploads tree, so the root form is no weaker than what it replaces. * feat(shared): add the book document contract for TREK Studio Millimetres throughout, not pixels: a pixel means nothing to a print shop and changes meaning with the device pixel ratio. CSS maps 1in onto 96px, 25.4mm and 72pt with a fixed ratio, so the editor can render the document at a scale and the print renderer at 1:1 and land on the same page. Paint order is the array order rather than a zIndex field that can disagree with itself, text elements may stay bound to the journal entry they came from, and a spread can park content a layout has no room for instead of dropping it. * feat(journey): open TREK Studio over the journey Studio is a child route of /journey/:id and portals itself above it, so the journey stays mounted and shows through the panel's 16px margin — it reads as something opened on top of the journey rather than a place you navigated to. The URL exists for reload, the back button and shared links; the user never sees it. Every rule in studio.css is scoped under .trek-dash on purpose: dashboard.css:95 resets button font, colour, background and padding at a specificity a bare .st-x loses to, so an unscoped rule silently does not apply to a button. Escape clears the selection and only leaves on a second press. In a dialog Escape means go away; in an editor that reflex would cost you the page. * feat(journey): build, edit and arrange the book in Studio The auto mode turns a journey into a book once and then gets out of the way: what it produces is an ordinary document, every element as editable as one placed by hand. Templates work the same way — applying one pours the spread's existing photos and text into the new arrangement and parks whatever will not fit, so trying a text-only layout does not cost you the pictures. Moving and resizing are hand-rolled on pointer events. The drag-and-drop libraries in this space move items between lists and have no notion of a free frame, a handle or a magnetic edge; HTML5 drag hands you a ghost image you cannot control and no position until the drop. It is used for exactly the one shape it suits — dragging a photo out of the content panel onto a frame. Selection chrome carries two rings, dark inside light. A single line vanishes against a photograph of its own value, and over a picture that is bright on one side and dark on the other no measurement of the background can be right. The sheet renders in DOM rather than on a canvas so the same component tree can be what the print renderer runs — one renderer, nothing to drift against. Edit affordances live in a layer above it and can never reach the page. * i18n(journey): studio strings across all 23 locales The empty-frame prompt breaks per language rather than copying the English line break onto everything — forced onto Japanese or Arabic it strands a fragment on the second line. * refactor(journey): keep SpreadView to components only FONT_STACKS and photoSrc move to their own module: a file that exports both components and constants breaks Fast Refresh, and this is a file you edit constantly while designing a page. Types come from the journey store instead of any, and the count beside the content tabs is a badge rather than competing with the label for the same weight. * feat(journey): more shapes, decoration and a content search in Studio Six shapes now instead of three — rounded rectangle, triangle and an outline-only box join the rest, plus a quotation mark and an outlined circle under decoration. A triangle is a clip path rather than the old CSS border trick: that hack cannot take a fill gradient or a stroke and its size does not follow the frame the way everything else does. A stroke sits inside the frame, or the drawn shape would be wider than the box the editor snapped and the print would not match it. The content panel gets a search over photos and entries. A photo matches on its own caption and on the entry it hangs from — most photos carry no words at all, so matching captions alone would look broken on exactly the journeys that need it. Plain filtering over what is already in memory; a journey holds tens or hundreds of items, not thousands. Dates in the panel and in the book now follow the app's language through the house formatDate rather than the browser's locale, and the entry's date and place are two badges instead of one dot-joined string the eye has to parse. * @ feat(journey): a shape library, picture frames and photo grids for Studio Studio had six shapes, two frames and no grids. This is the library that makes it usable for a book rather than for a diagram. Shapes are SVG paths now, not clip-paths. That was forced rather than chosen: a clipped div cannot take a stroke — the clip cuts the border in half lengthwise — and a heart is not a box with a radius. Rectangles and ellipses keep their old div rendering, since a box genuinely is better as a box and every document written so far contains those two. Two decisions in shapes.ts are worth stating. The path *points* are scaled, not the coordinate system. Fitting a path with preserveAspectRatio="none" scales the stroke with it, so a 0.5mm outline on a frame twice as wide as it is tall comes out 0.7mm on the sides and 0.35mm top and bottom. Printed next to a straight rule at 300dpi, you see it. Hence the deliberately boring path subset: absolute M/L/C/Q/Z, numbers alternating x and y, no arcs. And every shape fills its 0..100 box exactly, enforced by normalise() at module load rather than asked for in a comment. The editor draws its selection outline, its resize handles and every snap target from the element frame, so a shape occupying 86% of its own frame cannot be aligned against anything you can see. It costs a regularity nobody can spot — a hexagon in a square frame still reads as a hexagon. Frames are the same list: a picture frame is a shape with a photograph inside it, and keeping two would mean a heart that exists as one but not the other. Photos gain a mask and a decoration, kept independent, plus the Polaroid, film and tape treatments that are not expressible as either. Grids take their gutter out of the cells rather than adding it between them, so a grid asked to fill the safe area fills it instead of overhanging by one gutter. @ * @ feat(journey): derive what a journey adds up to GET /api/journeys/:id/stats — distance, days, steps, photos, places, the furthest point, the countries in visit order, and the route itself. Read only and derived: nothing here is stored, it is what the trips added to the journey come to. The route comes from the journey entries where they carry coordinates, and falls back to the places on the linked trips where they do not — which is the common case for a journey assembled from trips nobody has written up yet. The two are never mixed: an entry written about a place that is also on the trip would be two stops at one location, and the distance would count that leg twice. Countries read place_regions first, which Atlas already fills, and fall through to getCountryFromCoords for the rest. That import is a plain function from a module built without DI or Nest edges, so it costs the journey domain no coupling to Atlas. Distance is great-circle metres, not driving distance: there is no routing engine here, consecutive stops are not necessarily joined by a road, and a book that prints a road distance it never measured is worse than one that says "as the crow flies". Metres because kilometres and miles are a display choice. A hotel across three nights is one place with three day assignments, so the place query aggregates back down to one row at its earliest day — otherwise the route would visit the hotel three times. Two test fixes came out of writing this. journey.controller.test.ts still asserted an absolute path from res.sendFile, which the photo fix in this branch had already changed to the basename-plus-root pair; and linkTripToJourney in the factories wrote to linked_at, a column that does not exist — it had no callers, so it had never once run. @ * @ feat(journey): travel elements — the route, the figures, the countries A photo book of a trip is not an album: the trip carries facts, and those facts make pages photographs cannot. Four new elements — a vector route map, a figures panel, a country page and a set of small marks — plus the mood, weather and pros/cons an entry already records. Every one of them carries its own values, resolved when the element is placed and written into the document. The print renderer is headless Chromium loading a page; one that needs an authenticated fetch to know what it says will print blank the day a token expires. It also makes a book a record of a trip as it was, rather than something that quietly rewrites last year distance when a stop is added. travelRefresh compares what is stored against the journey and offers an update, so bringing an element up to date is a choice. The map is vector, from the coordinates, over silhouettes simplified offline from the admin-0 boundaries the server already bundles for Atlas — no licence question, nothing to fetch at render time, sharp at any print size. It paints no background: a map is geography sitting on the paper, not a window cut through it, so it can be laid over a photograph. Flags are drawn rather than typed. A regional-indicator pair is the obvious answer and works everywhere except Chrome on Windows, which has no flag glyphs and renders the two letters instead — "DE" in a printed book is not a flag. Thirty-three flags are exact constructions; anything with an emblem or unequal bands is deliberately absent and falls back to the country outline, because a wrong flag is worse than no flag. Panel tiles render the real element small, through the page own renderer. These differ from each other by what they say rather than by their shape: four map styles are four maps, and no icon can tell you which is which. @ * @ feat(journey): manage spreads from the pages rail Add, insert between two spreads, duplicate, reorder and delete. None of it existed — a book was whatever the auto layout produced. The cover and the back cover are fixed points: a book has exactly one of each, they are single pages, and no sequence of clicks should be able to produce a book with two covers or none. Every operation asks one predicate whether a spread is inner, rather than each caller testing role for itself, and a spread inserted after the back cover lands before it. Duplicating re-ids every element it copies. Two elements sharing an id would make selection ambiguous and every lookup that follows it wrong, delete included. Also: a locked element can be selected again. Locking used to switch its hit target off entirely, which was a dead end — it could not be picked, so the inspector never showed it, so the unlock button was unreachable and the only way back was undo. Locked now means what it says: it cannot be moved, and its resize handles are hidden so the editor does not offer a drag it will refuse. @ * @ feat(journey): let the auto layout use the travel elements The book now opens on a summary spread — the route drawn on the left, the figures on the right — and, for a journey that crossed a border, a country page after it. Both are omitted rather than left empty when there is nothing to draw: a spread holding a blank frame over the words "0 KM" is worse than a shorter book, and every page in a printed one costs money. Only the figures the journey actually has make it onto the page. A zero is not a fact worth a tile, it is a hole in a composition. Each entry gains a short accent rule above its heading — one drawn element, and the cheapest thing here that makes a spread read as designed rather than as text placed on a page. An entry with no photographs, which is the one spread with a blank left page, sets its date as a numeral there: a gap in the book becomes a pause in it. The back cover closed with `${places} Orte` — German, hardcoded, in a book that follows the app language everywhere else. It is a figures element now, so it takes its labels from the same translations as the rest of Studio. The layout waits for the figures rather than racing them. Laying out first would give a journey a summary spread or not depending on which promise resolved first, and Studio already shows its loading state until the document exists, so the wait costs nothing. @ * @ feat(journey): the Studio wordmark replaces the book-name field The field asked for a second name for something already named after the journey — a box whose only real use was being left alone. The bar says what this is instead: the lockup, inline so it takes the theme ink through currentColor rather than needing a light-on-dark copy, and a beta mark beside it. Along with the strings for everything in this branch, across all 23 locales, and the two keys the name field used, removed rather than left as orphans nobody can tell from live ones. journey.studio.frames was "Picture frames" — too long for a tab sharing a row with two others, and untranslated in 21 of the 23 locales, which showed the English through. It is one word now, in every language. @ * @ feat(journey): a free trim size, page numbers, and auto layout as a button Three from the list the PR left open. **Custom trim.** The five presets are what vendors actually bind, which covers almost everyone — "almost" being the problem. A local printer with a 24x18 press, or a book meant for a particular shelf, could not be made here at all. Two fields under the format list, and typing in them *is* picking custom: a book that is 210 by 240 is not square-21 with a typo, so the preset follows rather than needing to be chosen first. Switching to custom keeps the page it is on — it adjusts the format you have. **Page numbers.** Set on the document and drawn by the renderer, which is the only place that knows what number a page is. Stamping them with pdf-lib afterwards would print numbers the editor never showed, and a book you cannot proofread on screen is not much of an editor. They are also the one thing on a page that is not an element: an element holding "14" would still say 14 after its spread was moved. `startAt` exists because the first inner spread is rarely page 1 once bound, and outer/inner is a real distinction on a spread — getting it backwards puts both numbers in the fold. The controls live in the inspector empty state, which was one line of hint text. With nothing selected, that panel is where the book own settings belong. **Auto layout as a button.** It ran once, on open, which made it the one thing in Studio you could not ask for; a page that came out wrong had to be rebuilt by hand. Now it does one spread or the whole book, both as ordinary commits — the first thing anyone does with a button like this is press it to see, and the second is want their page back. A single spread keeps its id so the rail does not scroll, and refuses on anything not built from an entry rather than replacing it with a blank. @ * @ feat(journey): cover layouts, and five more for the spreads The cover had none. The panel said covers are designed by hand, which was true and unhelpful — it is the page people care most about and the one they had no starting point for. A cover is a different problem from a spread and gets its own set rather than a filter over the existing one: it is a single page, the type is the subject rather than a caption to a photograph, and a spread layout applied to it lands half its frames past the edge. Five of them, from full bleed to type-only, and the panel serves the right set for whichever spread is open. The cards scale as one page there, and drop the fold line, since there is no fold. Five more spread layouts as well — a picture with a narrow column of story, nine up, a mosaic around one large frame, two pictures with the words between them, and four staggered so a row of squares stops reading as a contact sheet. Applying a layout also stopped mangling a single text. The old rule took the longest text as the story and looked for a heading among the rest, which reads a three-text spread correctly and gets a one-text cover exactly wrong: the 30pt title *is* the longest text, so it was the story, so a cover layout with a heading slot and no body slot had nowhere to put it and parked the title. Size decides the heading now; length only sorts what is left. @ * @ feat(journey): seven self-hosted book faces, and a picker that shows them The serif slot was Georgia. Georgia is a system font — on most desktops, on no Linux container — so the print renderer would have substituted something else and a book proofread in one typeface would have printed in another. The existing Journey PDF export has exactly this bug today, asking for Inter while only Poppins is bundled. Every family is self-hosted through @fontsource now, all OFL, all loaded with Studio own chunk so a face cannot arrive after the text has been laid out and reflow the line endings someone was setting. Two sans, three serifs from bookish to high-contrast, two display faces for a cover. Every stack ends in a generic rather than in another named font nobody shipped. The three original ids are kept by name, so documents written so far still parse — they point at bundled faces rather than at whatever the machine happened to have. The picker sets each family in itself. A row of chips reading "Poppins / Lora / Bebas" in the interface font tells you their names and nothing about the only thing anyone is choosing between. Weights a family does not ship are disabled rather than offered: asking for bold on a single-weight display face gets a synthesised one, which prints as a smeared regular. Picking such a family moves the weight to the nearest it really has. @ * @ feat(journey): real map imagery, from the providers TREK already has The map element drew country outlines and nothing else. That is still the default and still the right one — nothing fetched, nothing licensed, sharp at any print size. But an outline of Iceland cannot show which road you took, and some books want that. So two more sources, both reading the tile template and Mapbox token an admin already configured for the planner and Atlas. A second place to paste a token is a second place for it to be wrong, and a source with nothing behind it is not offered at all — showing "Mapbox" to someone without a token produces a grey rectangle and no explanation anywhere. Both costs are stated rather than hidden: tiles are fetched when the page renders, and they are raster, cut for one zoom, so printing much larger than they were fetched goes soft. Attribution is neither optional nor a setting. The licence requires credit and a book is a published work — nobody can add a footnote after it is bound. The credit is matched on the host, so an instance running its own OSM mirror still credits OpenStreetMap, and an unrecognised source gets none rather than an invented one. It is written into the document when the element is placed, so the renderer cannot lose it. The route is projected onto the tile grid when there is one. The vector map fits itself to country outlines, and a line placed by that fit sits next to the road rather than on it — the sort of error that only shows up once it is printed. Outlines are dropped under imagery, where they would be a second coastline over the one in the picture. @ * @ fix(journey): make the Studio type-check again The map element used tileView and projectOntoTiles without importing them, useMapSources declared a stricter frame type than any real frame satisfies, and the mood icon read a colour through an `in` check that types as unknown. The page fixtures in the studio tests predate page numbers, so they build a BookPageSetup that the contract no longer accepts — now parsed from the schema, which cannot drift from it. @ * @ feat(journey): the book is saved Studio laid a book out on every open and kept it in the tab. Close the tab and the afternoon went with it, and the auto layout was not a starting point but the only point. The document now lives in journey_books, one row per journey, and autosaves: quiet for a moment after the last change, or at the latest fifteen seconds in, so a drag across a spread is one request rather than four hundred. A stored book wins over a fresh layout on open, and closing the editor writes whatever is still queued. Everyone on a journey can edit its book, so the write carries the version it was made against and the update matches on it in a single statement. A save that has been overtaken is refused with the current record in the body, which turns "your work vanished" into a choice between two versions. The server broadcasts journey:book:saved to the other editors — the version, not the document — and a client with nothing outstanding takes the new one. A client with unsaved edits deliberately takes nothing and conflicts on its next save instead. @ * @ feat(journey): export the book The one thing Studio could not do. The button was there and disabled. A book now goes out as sheets: every inner spread cut down the middle into leaves in reading order, bleed carried out past the trim on all four sides, crop marks outside that saying where to cut. The cut is a window rather than a re-layout, so a photograph crossing the gutter still meets itself once both halves are printed. Spreads stay whole in the other mode, which is what you send someone to read. The browser makes the PDF, from the editor components at 1:1. Considered and rejected: headless Chromium on the server, and a PDF library drawing the pages a second time. TREK is self-hosted, and neither Chromium in the image nor a second renderer to proofread against is worth carrying when the browser already produces exactly what the editor shows — it is also how the other exports here work. What the browser will not write is PDF metadata and the TrimBox entries; the marks carry that instead, as they have since long before the format existed. Two things had to give. `SpreadView` clipped at the trim, which is right on screen and leaves a white hairline down every edge of a bound book, so print mode lets the page run out and the sheet does the clipping. And the print document is its own document: it carries the app stylesheets across so the seven bundled faces are the ones that print, and waits for images and fonts before it offers to save. @ * @ fix(journey): make the Studio popovers cover what they cover The auto-layout menu sat on the glass tokens, which carry 42-58% opacity when the user has transparency on. That reads as depth over the workbench, where the rails and the bar use it, and as a mess over the inspector, where this menu opens: two layers of text through each other, neither readable. The export dialog was worse — it named --panel and --card, which are not tokens here, so its background resolved to nothing at all and the whole thing was see-through. Both are opaque now. The other glass surfaces are left alone: they float over the workbench, and that is what the material is for. The print preview also fits the pane. A spread sheet is over 400 mm across, so at 1:1 the book ran off the side and had to be read by scrolling sideways. Screen only — the print stays at full size. @ * fix(journey): a cover keeps its own size, and a trim size can be typed Three things the export and the page setup got wrong. Spread mode made every sheet as wide as the widest so that one @page rule would cover them all. That put a cover — one page — in the middle of a spread-sized sheet with white either side, which is not a cover. Each sheet is now sized to what is on it, and the print CSS carries a named page rule for the single-page ones. The trim fields clamped on every keystroke, so typing 500 meant the field saw 5, clamped it to the minimum and wrote that back under the cursor: the number could not be typed at all, only nudged with the arrows. The field now keeps what is being typed and tells the document about values it can use. The arrows are unchanged, and leaving the field still clamps — someone who typed 5 and clicked away meant the smallest book. And the autosave could loop. The save effect depended on the whole store object, which is new on every render, so after a conflict — where the local document is by definition not the saved one — it was a save attempt per render: a 409, a re-render, another attempt. It depends on the callbacks now, and a conflict holds the autosave until somebody answers it. * feat(journey): page numbers pick their own colour A book has dark pages and light ones, often on the same spread, so one folio colour is wrong on half of them: the warm grey that reads on paper vanishes into a full-bleed night photograph, and white vanishes the moment the page is white. The way out used to be setting it per spread, which the document has no place for. The renderer asks what is under the number instead. It knows every element and where it sits, so it walks them from the top down and takes the first one that covers the spot: a shape's fill is arithmetic, a photograph gets white with a hairline of shadow — unknowable without decoding it, and dark more often than not once printed — and bare page takes the page colour. A heuristic, deliberately: the alternative is sampling pixels from an image that may not have loaded, in a renderer that also has to run for print. Anyone it gets wrong can still pick a colour, and picking one turns it off. * feat(journey): see who else is in the book, and where they are Two people editing the same document without seeing each other is how you get two people editing the same spread. So: a badge in the bar saying who has the book open, and an arrow with a name on it for each of them. The coordinates are millimetres on the spread, not pixels on a screen — the two of you are at different zoom levels on different monitors, and a pixel means nothing to the other one. They carry a spread index too, so a pointer on page 40 is not drawn on page 2. Ephemeral throughout. Nothing is written down, the room is the authorisation for the pointer path, and a socket that dies takes its arrow with it rather than leaving it on everyone else's page. Presence is keyed by socket because two tabs are two pointers; the badge folds them back into one person, because two tabs are not two people. The rate limit needed room. Pointers move about ten times a second, three times what the per-socket limit allows, and that limit is what stops a client flooding the process — so it is now two: an outer ceiling every frame counts against before parsing, and the original tight limit on everything a pointer is not. Malformed JSON still counts against the tight one, which is what the guard was for. Throttled to ten frames a second going out and interpolated coming in: sixty would be five times the traffic for something the eye cannot use, and drawing ten as they land reads as a stutter rather than a hand. * fix(journey): keep the zoom bar on screen at every zoom level Zoomed far enough in, the bar slid off the bottom of the window — and it is the only way back out, so the editor was stuck at 300%. The workbench sat in a grid track sized `auto`, which grows to whatever is in it; `overflow: auto` on the child does not stop that, because a grid item's minimum size is its content unless told otherwise. So at 300% the box grew to 2400px inside a 660px window and took its absolutely positioned bottom edge with it. The track is bound now, and the workbench scrolls instead of growing. The bar also has a z-index, for the same reason it has to stay in view: it must never be the thing something else covers. * feat(journey): Studio replaces the old book export The journey PDF and Studio were two ways to print the same book that disagreed about what it looks like — and only one of them can be edited. The old export goes: the two buttons on the desktop already sat next to the Studio one, and the renderer they called is deleted rather than left as a second answer. Nothing takes its place on the phone. The book is a Studio document now and Studio is a desktop editor; a phone-sized PDF of something laid out for print was the old export's answer to a question nobody was asking. * feat(journey): lay the book out the way a travel book is laid out The auto layout built every spread the same way: a picture on the left, words on the right, and nothing else. It came out looking like a template because it was one — and on a journey with little in it, like a stack of blank paper. Five layouts now, chosen by what an entry has and alternating as the book goes on. A place page for a stop nobody wrote about, with the country pale behind the name and the coordinates under it. A story page with a small map of the stop and the picture bleeding off three edges. A panorama across the fold. A gallery with the hero on one page and a ruled strip on the other. And every fourth picture spread goes full bleed with the words set over it, because a book of loud pages has no loud pages. The marks are what actually make these pages: a flag beside the country, a date numeral, a chip saying which day this is, a rule along the foot with a dot showing how far in you are. Each is trivial and together they are the difference between a page that was designed and one that was filled in. All of them are elements the panels can make, so what comes out can be taken apart. The summary spread gained a heading and the furthest point drawn as two dots and a line — that figure means nothing until it is a distance between two names. The countries page went dark, because the printed one is: pale outlines on near-black is the single most recognisable page in these books. Two things the old layout got wrong are fixed on the way. Entries with nothing on them share one page instead of taking a spread each, in the order they happened rather than gathered at the end. And an entry whose photographs have not arrived gets the frames they will go in, empty, rather than blank paper — the layout is finished and the pictures are the only thing missing, which is the right way round. * feat(journey): build the spreads out of areas, and set the elements in ink Two things, both about what a page is made of. The layouts were photographs with captions. A printed travel book is built out of areas: a page laid solid in ink with pale type on it, a band down the outer edge, a picture that overruns the panel it sits against, a box ruled around a block of text. Two more layouts do that now — one with a whole page in ink and a second photograph crossing the fold onto it, one with an edge band and the words in a ruled box, pictures at two sizes and one overlapping the hero. Six layouts on a rotation, so the book stops reading as a template. None of it needed a new feature. The document paints in array order, so a panel pushed first is a panel everything else lands on; that is all layering is, and it needed using rather than adding. And the travel elements are ink by default rather than the app's orange. A book is printed and a printed page is ink on paper; a colour that arrives without being chosen turns every element into the same accent whether the book wants one or not. Picking one is a click. The dark map is the exception — the route goes pale there, because ink on a near-black country is a line nobody can see, and only the default is overridden: a colour somebody chose stays theirs. * fix(journey): three things the editor got wrong An empty photo frame rendered on its own, ignoring frameStyle entirely — so a Polaroid placeholder was a plain dashed rectangle until a photograph landed in it and the chin appeared from nowhere. The two branches are folded together now: the surround is drawn once and only what goes inside it differs, so a frame shows what it will look like before it is filled. Adding a page to a book with no inner pages yet put it in front of the cover, where it could not be moved back from either — a move only ever swaps with another inner spread, and the cover is not one. An empty book reports its last inner spread as -1, and -1 + 1 is 0. The insert is bounded at both ends now. And snapping only knew the outer safe lines. A spread draws that dashed rule inset from each of its four vertical edges, so dragging inwards caught the fold and nothing else — the line you could see just before it was not a target. All four are, along with the centre of each page and the quarters within it: on a spread the halfway mark is the fold, so a picture centred on its own page had nothing to find. * feat(journey): take the auto layout's spreads from templates drawn by hand The layouts written as code are what a function can reason its way to: a picture here, words there, margins that add up. What they are not is designed — a panel bled off one edge, a shape running off a corner, a strip of pictures at two sizes with the coordinates set beneath them. Those decisions come from looking at a page, and the editor is where looking at a page happens. So a spread built in Studio can now be the layout. `extract-templates.cjs` reads a journey's book and writes its spreads out as data, with every measurement divided by the page it was drawn on — a template built on a 210mm square lays out on an A4 landscape book without being redrawn. `applyTemplate` does the other half: it fills what the entry can answer for and copies everything else as drawn. That division is the whole contract. Text carrying a binding takes the title or the story; empty frames take the photographs in order; the day, coordinate, date and country marks take what the stop knows. Panels, rules and decorative shapes are the design and are left exactly as they were put. A template is one *for an entry* when it uses one — which has to come out of the drawing rather than a label somebody remembers to set. A summary spread of figures and country outlines reads perfectly well on its own, and dropping a day's photographs into it would be nonsense. Two templates ship with this, drawn by the person who will use them. The built-in layouts stay as the fallback for entries no template suits. * feat(journey): turn elements freely, and pass a spread on as a file Rotation by the corner, the way it works everywhere else: a handle sits diagonally outside each of the four corners of the selection, and dragging one turns the element by the change in angle rather than to the angle under the pointer, so it can be picked up anywhere without jumping. Held to 15 degree steps unless shift is down. Four handles rather than one because a single handle off the top right sits under the inspector for anything in the right page's upper half. And a spread can now leave the book it was made in. The zoom bar downloads the one on screen as a file; Import, beside Add spread in the pages rail, brings one back. Measurements travel as fractions of the page, so a spread drawn on a 210mm square lays out correctly in an A4 landscape book, the same way the auto layout's templates do. What deliberately does not travel: - Photographs. The file carries the design, and the frames arrive empty. - The map source. A static map freezes the URL it was rendered from, and on a Mapbox instance that URL has the access token in it, so a file meant to be posted in a forum would carry a credential. Coming the other way, a tile template from a stranger is a URL every reader's browser would fetch tile by tile: an IP address handed to whoever wrote the file. An imported file is treated as what it is, somebody else's JSON. It is read in the tab that chose it and never uploaded, parsed and never evaluated, and every element goes through the document contract, which drops unknown fields and range-checks the rest. Colours in particular are #rrggbb or nothing. The size of the file and the number of elements are both capped, because the damage a hostile file can do here is not code execution, it is handing the editor more than the server will accept and leaving a document that will not save. Also fixes the rotation handle being drawn but not grabbable: the chrome layer and the selection box both pass pointers through, and a handle has to opt back in with pointer-events. * docs(wiki): add two Studio screenshots for the addon page The editor with a stats spread open, and the frames panel. Both are what the Journey addon page will want once Studio ships, and both are wanted now to show the feature off while it is still in review. * test(realtime): cover the book room's refusals and its dead sockets The realtime coverage ratchet caught what the book room work left behind: the three handlers each have an early return for a message that is missing its journey id or comes from a socket with no user, and none of them was exercised. Every one of those is a silent failure by construction. A handler that did something with a missing journey id would not throw, it would put a socket somewhere it does not belong, and nobody would notice until two strangers were looking at the same page. The other half is sockets that are in a room but cannot be used: a connection that dropped before its close handler ran, or one put in a room without ever being registered. The peer list has to walk past both rather than showing a ghost, and the broadcast has to skip them rather than throwing on a path that runs ten times a second per editor. Both files are back to full branch coverage, so the domain's pins hold as they are rather than being lowered to fit. * feat(journey): make the route map a map of the journey Four things were wrong with it, and they compounded. **It showed the wrong place.** The view was fitted to the country outlines as well as the stops, so a trip that stayed inside Berlin was drawn as the whole of Germany with two dots in the middle of it. It fits what the journey did now, and the outlines run off the edge of the frame the way a coastline does on any real map. Fitting to the country is still there as a deliberate choice, for the page every travel book has, and how much air to leave around either is a setting rather than a constant. **It drew a line nobody travelled.** Stops joined in order is a claim about the journey that is almost always false: it crosses mountains, water and borders the trip went around. TREK already stores routed geometry per place, from the planner and from imported GPX, so the map now follows the road where the trip knows it and falls back to joining the stops where it does not. Segments stay separate, so a trip with a flight in the middle does not grow a road across the sea. The geometry is thinned when it is frozen into the element: a printed line gains nothing from a point every fifteen metres, and a book carrying every GPS fix of a three-week trip is a document nobody can save. **The tiled and static sources drew nothing at all.** The tile grid was computed, the route was projected onto it, and then no picture was ever rendered — the map came out as a frame with a line across it. Three separate faults behind that: the imagery layer did not exist, `{s}` was left unsubstituted so every tile URL named a host that does not resolve, and the grid was cut from the tiles the route happened to sit on rather than from what the frame shows, so it stopped short of the edge. The frame decides the grid now, and it covers by construction. Tiles overlap by a tenth of a millimetre, which closes the hairline of white paper that rounding left between them. Mapbox needed one more thing: `mapbox/standard` is a 3D GL style and the Static Images API refuses it outright, so an instance configured for the planner's map was configured with a style this cannot use. It falls back to the classic equivalent, and a URL frozen into a document before that existed is repaired on the way out rather than left broken for good. **A map was always a rectangle.** It can be cut to the outline of the countries now, so the picture *is* the country: no frame, no box, the page showing through around the coastline. That is the version worth laying next to a photograph, and the one thing a rectangle can never be. The tile grid and the vector fit are projected from one extent so the picture and the shape it is cut to line up — two fits meant the country was full of the wrong towns. Also here: the credit line comes off the map itself. It is still resolved and still stored, for the colophon, which is where a book has always credited its sources. * feat(journey): split the country list, and trim the map cards The country list and the country grid were compositions somebody else made: they decided the order, the spacing and the type size, and the only way to change any of it was to not use them. They are gone, and what is left is the same entry — the name over its silhouette, set the same way — as an element placed one country at a time. Three down a page is the list, with the spacing yours; one at 80mm is a chapter opener, which the list could never be. The name is editable, so numbering them "1. Germany", "2. Netherlands" is typing rather than a feature. The compact mark, outline beside the name at the size of a line of type, stays for the places that want a mark rather than a heading. The map section offers the four vector styles and nothing else. Tiles, Mapbox and the cut-out are one click away in the inspector, where the rest of the map's settings already live, and four cards that are the same map four times were crowding out everything under them. A map is fitted to the country by default now, which is the picture a travel book usually wants. Fitting to the stops is still there and still matters the moment the trip is smaller than the country it happened in. Also: no navigation fallback from the dev service worker. In production it is right — offline, a deep link has to be answered by the cached shell. In development it answers a reload with the index.html it cached earlier, whose script tags point at module URLs from before the last restart, so the browser re-runs the previous version of the app while the editor shows the new one. Every explanation for that is wrong until someone thinks of the service worker. * fix(journey): drop what the trimmed map section left behind Three bindings that only fed the cards removed in the commit before: the map sources hook, the country codes the cut-out card needed, and the frame the preview sized itself from. Lint had them as warnings rather than errors, so they would have ridden along quietly.	2026-08-19 23:36:42 +02:00
michael-bohr	55aef8d55c	fix(tests): generate trip days in UTC so a DST shift can't drop or repeat one ... The test trip factory parsed date-only ISO strings as UTC midnight but stepped the cursor with setDate(), which advances local wall-clock time. Across a DST transition that step is 23h or 25h, so the instant drifts off midnight and toISOString() reports the wrong day — a day is dropped in autumn and repeated in spring. TRIP-SVC-015 already builds a trip over 2025-11-01..2025-11-03, which straddles the US fall-back, and fails on any machine in a DST-observing zone: AssertionError: expected [...] to have a length of 5 but got 4 CI runs UTC, where the loop happens to be correct, so this is invisible there and only bites contributors running the suite locally. Full server suite: 396 files, 7550 tests, green.	2026-08-18 13:37:06 +02:00
jubnl	72221a2e45	feat(auth): sliding session renewal past half the token lifetime (#1927)	2026-08-15 22:48:16 +02:00
jubnl	1239be4259	refactor(server): fold the _shared MCP helpers into an injectable guards provider; delete the last bridge	2026-08-11 23:11:34 +02:00
jubnl	954a3ca0a7	refactor(server): serve /mcp from a Nest controller; delete auth, audit, addons and oauth bridges	2026-08-11 23:01:19 +02:00
jubnl	f842073351	refactor(server): delete airtrail.bridge and notifications.instance via a core/pull split	2026-08-11 21:13:32 +02:00
jubnl	c1819c7ab5	refactor(server): delete assignments.bridge via an assignments-domain module split	2026-08-11 20:58:37 +02:00
jubnl	079064fdcd	refactor(server): delete trips.bridge via leaf membership reads and prompt relocation	2026-08-11 20:28:49 +02:00
jubnl	8b7b91d814	refactor(server): let user-cleanup inject BudgetService and delete budget.bridge	2026-08-11 16:42:49 +02:00
jubnl	7880eba6fb	refactor(server): move the journey resources onto the registry and retire src/mcp/resources.ts	2026-08-11 16:15:12 +02:00
Maurice	d981719941	Serve /ws from a Nest gateway with its own adapter ... The transport was a hand-rolled setupWebSocket(server) that index.ts kicked off with a dynamic import after listen(). It is a @WebSocketGateway now, with DatabaseService and EphemeralTokenService injected instead of imported, and the heartbeat owned by a lifecycle hook rather than an interval nobody stops. The wire protocol does not move. Nest's WsAdapter dispatches on { event, data } and every deployed client sends { type, tripId }, so TrekWsAdapter translates rather than asking clients to change. It also builds the ws server itself instead of delegating: the base's port-0 branch uses noServer and performs the upgrade from its own registry, which never consults verifyClient, so delegating would have dropped the origin check and answered 101 to anyone. The per-socket error listener stays attached first, because an unhandled one kills the process (#1576), and the flood guard counts every inbound frame before parsing, because malformed frames are exactly the ones worth limiting. Four things had to stay where they were, and each is a silent failure if it does not: The socket registry stays module state. Seventeen bridges and notifications.instance build `new RealtimeService()` outside the container; rooms on a provider instance would leave their broadcasts going to an empty map, with no error and no log. The socket id stays a monotonic integer. The client echoes it as X-Socket-Id and broadcast excludes the originator with Number(excludeSid). A uuid is NaN, NaN === NaN is false, and every client would receive its own writes back, which shows up as drag-and-drop that jumps rather than as an error. buildApp creates the http server and binds the adapter before app.init(), and callers take it from getHttpServer(). Nest binds gateways during init, so a later adapter binds nothing; an adapter given the app binds to Nest's own internal server, which this process never listens on. Both boot green with no client able to connect. RealtimeGatewayModule is imported by AppModule alone. RealtimeModule is @Global, so a gateway there follows into every hand-assembled TestingModule, and Nest's SocketModule then loads an adapter none of them set: it reaches for @nestjs/platform-socket.io and calls process.exit(1). Eighteen e2e harnesses died that way before the split. src/websocket.ts survives as a re-export of the three fan-out primitives. 115 test files vi.mock that path to assert on broadcasts. The two transport suites pass unchanged, and 30 new cases pin the pieces directly: the pv and MFA gates, the numeric socket id, the plugin announcement firing before the room check, both sides of the origin allowlist, and the flood guard counting frames no handler wants.	2026-08-10 21:46:47 +02:00
Maurice	ba7d55f999	Finish the contract ratchet, the upload bridge and the client leftovers ... BODY_CONTRACT_ALLOW_LIST is empty. The last seventeen handlers type their body with a createZodDto class, so the fail-closed boot gate has nothing left to forgive; it still refuses a boot for a new handler that reads @Body() without one. Several of those contracts describe rather than constrain, and that is the whole care in this change. The pipe runs before the handler, so a schema stricter than the handler moves a user-visible answer: - TagsController.create answers { error: 'Tag name is required' }, pinned byte-for-byte in two tests, and the pipe formats as `field: message`. The DTO leaves name optional and the handler keeps the check that owns the message. Same shape for the booking-import confirm body, which additionally gains per-item validation the handler never did. - PluginsController.activate and install answer 503 when plugins are disabled, and check that BEFORE looking at the body. A schema that rejected first would turn that into a 400 for an operator whose server has plugins off. - setEgressHosts reads a non-array `hosts` as "clear the list", which is the documented reset. Typing it as string[] would have removed a working admin action rather than tightened anything. - PluginRoutesController.route answers { route: null } at 200 for everything it dislikes, so the client falls back to straight lines. A 400 there would turn a graceful degradation into a visible error. files.bridge is gone. The multer options are built by MulterModule.registerAsync from an AllowedFileTypesService leaf, so the fileFilter reads the operator's extension list from the container instead of from a second FilesService built outside it. Nest injects MULTER_MODULE_OPTIONS with @Optional(), so a token that fails to resolve is not a boot error: it silently falls back to defaults, with no filter and no size cap. FILE-020 already proved that for trip files by uploading an .svg over HTTP and expecting 400; journey uploads had no such case, and now do. VIDEO_UPLOAD is untouched, including the filename callback that forces .jpg regardless of what the client sends, which guards the public share proxy. PluginFrame gets an onError. A frame whose document fails to load left a blank element at full height, which reads as a hung app rather than as a plugin that is gone. typecheck:tests runs in CI now, with the test tree at zero errors. tz-lookup is left as it is: the build puts it in a lazy helpers chunk, not the entry chunk, and the remaining split would trade a synchronous render for an async one to move 172 kB that is already off the critical path.	2026-08-10 19:54:46 +02:00
Maurice	49c3c57c31	Give the ephemeral tokens a provider, and clear the next wave of type errors ... ephemeral-tokens.ts was free functions, and AuthService owned the cleanup timer only because it happened to be the domain that mints tokens. Issuing them and sweeping them are different jobs, and FilesService and TokenService mint or consume them too. EphemeralTokenService owns the lifecycle and hands the three operations out. The store and the interval stay module state next door, and that is load-bearing rather than a leftover: src/websocket.ts consumes ws tokens on the upgrade handshake, outside the container, before any injector is in reach. Per-instance state would hand it an empty Map and close every connection with 4001, which no test would catch because the ws suites drive the transport directly. WS-027 through WS-029 pin the session gate that runs through exactly that path. The MAX_STORE_SIZE back-pressure is the second reason: createEphemeralToken returns null at 10,000 live tokens and TokenService turns that into a 503. A second store would raise the real ceiling with nobody noticing. Its own leaf module rather than a provider in AuthModule: TokensModule mints download and ws tokens as well, AuthModule already imports TokensModule, and TokensModule is documented as a deliberate leaf that three graphs reach for. Same shape as MailerModule, which broke AuthModule <-> NotificationsModule. Twelve hand-wired construction sites in tests needed the new collaborator. The typecheck named all twelve; before this branch they would have been undefined at runtime. Sixteen more test files are cleared here too, each at its root cause. Four of them were passing for the wrong reason: files.controller.test.ts drove two handlers with shifted arguments, a string tripId where the trip row belongs and undefined where tripId and id belong. It stayed green because FilesService is fully stubbed and the stubs ignore what they are given, so DELETE /:id/permanent and DELETE /trash/empty never covered that the trip row reaches the permission check. conflictUpdate.test.ts was missing real collaborators on PlacesService and PackingService. None of the exercised paths reach them, so it passed by luck. assignments.service.test.ts builds its service by hand, and the one consumer of the collaborator it was missing swallows every throw in a bare catch. A broken journey reconciliation would still have shown 28 green tests. scheduler.test.ts mocks two modules with paths that resolve one directory above the server root, so they mock nothing at all. Harmless only because src/scheduler.ts imports neither.	2026-08-10 19:54:46 +02:00
Maurice	4780a7be90	Typecheck the test tree, and fix what it found ... server/tsconfig.json has include: ["src"], so tests/ was never typechecked. A service that gained a constructor parameter did not break its hand-wired call sites at compile time — the argument arrived as undefined and threw at runtime, if anything read it at all. The notifications sweep hit 46 such sites and only a stash-diff against a throwaway tsconfig found them. tsconfig.tests.json makes that permanent. It is not wired into CI yet: the tree still reports 170 errors, and turning it on now would block every unrelated PR. Three of the first fixes were not type noise. DAY-SVC-034 asserted that createAccommodation rolls back a failed reservation insert. That method moved to AccommodationsService in the days/accommodations split, so the case was calling undefined — which throws, which satisfied .toThrow(). The rollback has been unchecked ever since, while the case reported green. Repointed at the owner; the invariant holds. host-rpc.test.ts typed its response as RpcResponse & Partial<RpcError>. Both carry ok, one as true and one as false, so the intersection is never and all 97 property reads in the file were errors nobody could see. auth.controller.test.ts passes {} as the body in cases that stub the service and assert on the mapping around it. That is correct as written — the point of several of them is that the error path never reads the body — so anyBody() names the intent instead of inventing fields the assertions do not read. Three changePassword calls were genuinely missing the @Res() argument.	2026-08-10 19:54:46 +02:00
Maurice	6cf5760383	Inject the notification senders instead of importing them lazily ... Nine fire-and-forget sends reached notifications.bridge through import('...').then(({ send }) => ...). The laziness was working around a module cycle that no longer exists, and it cost twice: it hid the edge from the module graph, and it handed each send a NotificationsService built outside the container rather than the container's own. The sweep needed a method rather than a grep. tests/ sits outside tsconfig's include, so a service that gains a constructor parameter does not break its hand-wired call sites at compile time — the argument arrives as undefined and throws inside the send. Adding tests to a throwaway tsconfig and diffing the errors before and after named all 46 sites exactly. The same config reports 288 pre-existing errors in the suites, almost all deliberate partial constructions in the harnesses, which is why tests/ is not in the build's include; that cleanup is its own piece of work and is written down in the nest README. notifications.instance.ts holds the out-of-container instance, apart from notifications.bridge.ts on purpose: several suites replace the bridge wholesale with vi.mock(..., () => ({ send })), and a sibling bridge taking its instance from there would break under those mocks. The suites that assert on a send now hand their spy to the injected service. The reservations e2e overrides the provider, because its app resolves the real one out of its own container and never saw the module mock.	2026-08-10 17:08:54 +02:00
Maurice	2d0eca7938	Let MCP addon gates read an injected service ... Nine *.mcp.ts files reached through addons.bridge for one boolean each, and platform.routes plus the legacy registrars still do. That was never a preference: a decorator's options object is built while the class is being defined, so the `when:` closure had no `this` to reach an injected service through, and the only thing in scope was a module-level singleton that builds its own AddonsService outside the container. Nine domains hid an edge to the addons domain from the module graph to answer "is this addon on". @trek/nest-mcp hands the gate its declaring instance now, resolved at attach rather than captured at module load, and addons/addon-gate.ts turns that into addonGate(ADDON_IDS.X) over the injected service. The option is declared with method syntax so a predicate written against its own controller class stays assignable. Two more edges went the same way, both checked for cycles first: reservations.mcp injects AssignmentsService (AssignmentsModule never reaches back), atlas.mcp and journey.mcp inject AuthService. The tests that forced a toggle by mocking the bridge module now write the addon row the admin panel writes, so they exercise the real read. Four in-container uses stay, each documented in the nest README: places.mcp (a real Days -> Places -> Assignments cycle), budget/packing/costs against trips.bridge, user-cleanup against budget.bridge, and the two multer interceptor options, whose fix is MulterModule.registerAsync.	2026-08-10 17:08:54 +02:00
Maurice	d95aa49c7f	Split the trip aggregate root into its parts ... TripsService injected fourteen other services. Almost all of them were there for two read aggregates - the MCP trip summary and the offline bundle - and for the member roster, not for anything the write path does. Reading is what fans out; writing is not. Membership goes to trip-members/: listMembers, addMember, removeMember, transferOwnership and the four guest methods, plus the six routes, which keep their paths. It is a NEW module, not the trip-membership/ leaf next door: deleting a guest erases their plugin data and re-splits their expenses, so it needs auth and budget, and AuthModule already imports that leaf. Giving it those dependencies there would have closed a hard cycle. This one is a sink - nothing imports it back except trips. The read aggregates go to trip-read-model/, which is where the nine-service fan-out now lives. What is left is the write core plus day generation, on eight parameters instead of fourteen: database, reservations, days, permissions, budget, vacay, realtime, unsplash. The last four are all reachable from updateTrip's date-shift transaction, which is why the count does not fall to three. Trips still reaches budget through ReservationsModule, so trips.bridge.ts survives this. Saying otherwise would have been the easy claim to make and it would not have been true.	2026-08-10 13:38:26 +02:00
Maurice	3d522be0e5	Give accommodations one home instead of two halves ... The routes lived in reservations/ while the SQL lived on DaysService, so the controller delegated every call across a domain boundary to reach its own data, and neither module owned the thing outright. The seven statements move into AccommodationsService unchanged and the domain gets its own directory, module, DTO, RPC and MCP surface. What stays in days/ is the reorder side: assertNoInvertedAccommodation and resyncAccommodationDays are about re-dating day rows, and the stay is the thing being carried, not the thing doing the carrying. Two edges fall out of this. AccommodationsService drops its DaysService dependency, and DaysMcp drops DatabaseService and PlacesService, because create_place_accommodation was their only user - which lets DaysModule stop importing PlacesModule and closes one leg of the latent Days -> Places -> Assignments -> Days cycle. DAY-SVC-016..026, 029 and 035 move to accommodations.service.test.ts with their case ids intact. The reservations e2e container assembles both modules now: it builds a single domain module on purpose, which is exactly what catches a move like this, and it caught it.	2026-08-10 13:38:26 +02:00
Maurice	ad312cdd43	Give day notes a domain of their own ... days/ carried two fachlichkeiten with a full file set each: days.controller, days.service, days.mcp, days.rpc, days.dto next to the five day-notes ones. The note files move out unchanged; because the new directory sits at the same depth, not one import path inside them changed. The two modules deliberately do not reference each other in either direction: dayExists is raw SQL on the days table in the note service, and DaysService reads day_notes the same way, so a module edge would buy nothing and cost a cycle. DayNotesModule has to be registered in PluginsRuntimeModule as well as AppModule - DayNotesRpc owns four of the 113 wire methods and the registry boots with requireTotalCoverage, so leaving it out would stop every test app that assembles the plugin runtime. The days e2e container assembles both modules now: the note routes still nest under the days prefix, and a container that builds only DaysModule would 404 on them while production served them fine.	2026-08-10 13:38:26 +02:00
Maurice	5a9ded6676	Move the calendar export off the trip aggregate ... exportICS and its four module helpers were 330 lines of RFC 5545 inside TripsService, and FeedsService had to import the whole trip aggregate to get an ICS string out of it. They move to a calendar domain unchanged - same statements, same escaping, same folding, same VTIMEZONE fallback - so the emitted bytes are identical on both the download and the feed. The 21 unit cases move with the code and keep every assertion, which is what makes that claim checkable rather than asserted. FeedsModule now imports CalendarModule instead of TripsModule, and its e2e container drops from the trip aggregate to two small modules. NotFoundError/ValidationError move to common/ so a second domain can raise them without importing the first one for its error types; trips re-exports them, so the nine files that import them from there are untouched. Fixes a harness that tsc cannot see on the way past: mcp-test-controllers built TripsService with 12 arguments for 14 parameters, leaving unsplash and userCleanup undefined.	2026-08-10 13:38:26 +02:00
Maurice	d4a1601855	Give the packing templates and the feature flags back to their domains ... Twelve admin packing-template routes sat on AdminController and reached PackingService through eleven pass-through methods on AdminService that did nothing but forward and cast. PackingService already owns all three template tables, so the routes move to AdminPackingTemplatesController next to it and the pass-through block is gone. AdminService no longer injects PackingService at all. The three places flags were raw app_settings SQL on AdminService, sitting beside bag-tracking and collab-features which it already delegated to AddonsService. They move to AddonsService, which owns every other flag, and AdminController now calls it directly rather than through delegating methods. The toggle ROUTES stay on AdminController, which is a departure from the plan and worth stating: an admin-gated controller in AddonsModule makes that module import AuthModule, and PluginGuardsModule imports AddonsModule precisely because it is a leaf — Nest refused to build the graph. Same for the addon CRUD, whose PUT cascades into PluginRuntimeService. Both notes are in the code. Paths, response shapes, the {error,status} envelope, the create-201 split and every audit action are unchanged.	2026-08-09 20:54:39 +02:00
Maurice	6680bc7c74	Split PluginsModule into four, and gate coverage per domain ... PluginsModule was 21 controllers, 24 domain imports and 10 providers in one class, which made it the hub most of the Nest graph ran through: AdminModule imported it for a single cascade-disable call and inherited all of it. It is now PluginsRuntimeModule (supervisor, capability router, hook contracts), PluginContributionsModule (the 14 read-only hook controllers, moved to contributions/), PluginOAuthModule (the credential leaf, moved to oauth/) and a composition root that keeps the install and delivery controllers. AdminModule imports the runtime alone. The three plugin files that reached for the db singleton alongside the injected DatabaseService no longer do. plugin-host-state and signature-status take the connection from the caller, and the three per-user settings functions that were bare exports 'so the RPC host wiring can call them directly' are now PluginUserSettingsService - the host wiring is providers, so it injects them. Coverage moves from one repo-wide 80% to a per-domain ratchet. The single number let a well-covered domain subsidise a thin one: booking-import sits at 50% and integrations at 20%, and the aggregate still cleared the bar, so either could have lost another ten points unnoticed. Each domain now carries its own measured floor, regenerated by scripts/coverage-thresholds.mjs. Two test-side findings on the way: expect(undefined).toContain(SomeClass) PASSES in this vitest version - it only throws for a string needle. Every '<X> is listed in its module providers' guard was written that way, so all twelve of them silently stopped guarding the moment their class moved. They go through expectRegisteredProvider now, which asserts the array shape first. The atlas region test paid for the one-off decompression of the multi-MB admin1 bundle inside its own 5s budget, which is why it failed under load and passed alone. The bundle is warmed in beforeAll instead.	2026-08-09 18:44:59 +02:00
Maurice	f72aba0c91	Finish the plugin RPC decorator rollout ... The last 20 wire methods move onto the decorators: db.* and the three unconditional methods (DbRpc), meta.* (MetaRpc) and the host-mediated surface of users/broadcasts/notify/ai/oauth/scheduler (HostSurfaceRpc). That closes the ledger at 113/113, so the legacy has() blocks in rpc-host.ts are gone and the router is down to what was never domain-specific: build the granted subset of the dispatch map, dispatch, audit, map errors. PluginHostDepsFactory was the 26-argument wiring sheet behind those blocks. With the handlers in the domains it has two dependencies left, so it is now PluginRpcHostFactory: the plugin's own sqlite handle, the inter-plugin router bound with this plugin as the caller, and the audit sink. The 18 host-to-plugin hook calls get the same treatment. They used to spell out the fn name and the timeout at each controller, which meant nothing checked that a hook:* grant on the consent screen had a consumer behind it, that the fn matched what the SDK documents, or that two call sites agreed on the budget. PluginHooks declares all 18 with @PluginHook and performs them, and the controllers call it by name. With both halves complete, requireTotalCoverage goes on: a KNOWN_METHOD without a handler, or a hook without a consumer, now fails app boot instead of surfacing as a PERMISSION_DENIED nobody can explain.	2026-08-09 17:38:56 +02:00
Maurice	294cfcd8d7	Move the addon-gated domains onto the decorators ... collab, journal, atlas, vacay and collections: 32 more methods, so the registry owns 93 of 113. rpc-host.ts is at 565 lines, down from 1332, and the deps factory at 384, down from 944. These five are the risky group, because their addon gates lived inside the deps factory's closure rather than in the router. A handler that calls its service directly still works, just without the check, and neither the compiler nor the router tests would notice. So addon-gates.rpc.test.ts walks all 37 gated methods as one table and asserts two things for each: with the addon off it is refused with that addon's message, and the service is never reached. The table length is pinned, so a later method added without a row is a failure rather than a silent gap. One ordering detail worth knowing: on the atlas writes the router evaluated its params before the addon gate inside the closure, so a malformed country code still reports BAD_PARAMS rather than the addon. The handlers keep that order. The collections service reports refusals as status-tagged errors rather than typed ones, so mapCollectionError came across with the handlers: 403 and 404 become RESOURCE_FORBIDDEN, 400 and 409 become BAD_PARAMS, and anything untagged stays a HOST_ERROR instead of being dressed up as a permission problem.	2026-08-09 16:38:43 +02:00
Maurice	010242b107	Move costs, reservations and accommodations onto the decorators ... Eleven more methods, so the registry owns 61 of 113. rpc-host.ts is at 771 lines, down from 1332. costs is the first addon-gated domain, and the addon check sits in a different place in each of the two reads: inside the membership callback for getByTrip, so a caller without trip access never learns whether the addon is on, and before everything for listMine, which has no trip to check. Both orderings are asserted. The writes keep their own refusal wording ("no permission to edit costs on trip N") instead of going through requireTripEdit, which words it differently. The booking paths are cascade-heavy and stay that way: creating a reservation can create an accommodation and a budget item, deleting one removes both again, and deleting a lodging block takes its partner reservation and budget item with it. Each cascade is a broadcast the web app relies on, so they are asserted by event name and order. CostsRpc reaches the trip list through trips.bridge rather than by injection. BudgetModule cannot import TripsModule, because TripsModule already imports BudgetModule; budget.mcp.ts uses the same escape for the same reason.	2026-08-09 16:38:43 +02:00
Maurice	2ec6d006b0	Move the trip surface onto the decorators ... Twelve more methods, so the registry owns 50 of 113. rpc-host.ts is down from 1332 lines to 830 and the deps factory from 944 to 500. trips.update keeps its two field-level gates: archiving and changing the cover each need their own admin-configurable permission on top of trip_edit, so a plugin cannot do either on a trip it may otherwise edit. Member management keeps its own grant for the same kind of reason, since adding a member grants trip access, and the owner still cannot be removed through it because that would orphan the trip. canEditTrip stays in HostDeps for now: the db:meta gate still resolves an entity's edit permission through it and has not moved yet.	2026-08-09 14:13:56 +02:00
Maurice	c326d39a07	Move places, days and itinerary onto the decorators ... Eight more methods, so the registry owns 38 of 113 and rpc-host.ts is under 1000 lines for the first time. itinerary.* lives in assignments/, not in days/, because AssignmentsModule already imports DaysModule and putting the handler the other way round would have closed a cycle. It keeps riding on day_edit, which is what the app gates it on. The delete path in places carries an ordering constraint that is silent when broken, so it has two tests of its own: the journey hook has to run BEFORE the row goes, because journey_entries.source_place_id is ON DELETE SET NULL and afterwards there is nothing left to detach, and the place id has to be scoped to the trip before the hook runs at all, because the hook keys on the place alone and would otherwise detach another trip's entries even though the delete itself is refused.	2026-08-09 14:13:56 +02:00
Maurice	dbb0016cac	Move the file surface onto the decorators ... Six more methods, so the registry owns 30 of 113, and the deps factory is down to 660 lines from 944. Files are the awkward corner of the plugin surface and stay that way on purpose. Reading a file's bytes is a separate grant from reading its metadata, because a passport scan is more sensitive than its filename, and the three writes use three distinct rights instead of one domain action. FILES-RPC-006 pins that by watching which permission each operation actually asks for. This is also the only plugin path that touches disk, so the tests lean on it: the extension blocklist, the size cap checked before the read rather than after, a path that resolves outside the uploads root, and the demo-account upload refusal that mirrors the REST guard.	2026-08-09 13:24:58 +02:00
Maurice	ca88676858	Move packing onto the decorators and de-duplicate its privacy fan-out ... Nine more methods, so the registry owns 24 of 113. The #858 privacy logic existed three times: PackingService had the primitives, the controller layered emitToViewers and broadcastUpdate on top privately, and the plugin deps factory carried a standalone copy of all four, with a comment asking for them to be kept in lockstep by hand. Migrating packing meant either copying them a fourth time or fixing that, so the two private controller methods moved into PackingService and the factory copy is gone. Controller and PackingRpc now call the same code, and the controller suite proves it by passing with all 45 assertions unchanged. The four public/private transitions get one test each, because each one is a way to leak a private item to the whole trip room, plus a test that the privacy is read before the write rather than after: reading it afterwards would report "already private", skip the room delete, and leave the item on every member's screen.	2026-08-09 13:24:58 +02:00
Maurice	62978aab5a	Move five more domains onto the plugin RPC decorators ... categories, weather, rates, todos and daynotes: 11 more methods, taking the registry to 15 of 113. Handler bodies and messages are verbatim; the ledger test tracks the split. Two things the move surfaced rather than introduced. PluginGuards could not stay in PluginsModule: that module imports 22 domain modules, so a domain importing it back for the guards would close a hard cycle and the only way out would be forwardRef. It now lives in a PluginGuardsModule leaf that imports nothing which leads back, the same shape MailerModule got for AuthModule. And the todo and daynote writes broadcast. Those events are not decoration, they are what keeps an open session from showing stale data after a plugin write, so they came across from the deps factory with the handlers, and there is a test that a failed write broadcasts nothing. Worth knowing for the next domains: todos are edited under 'packing_edit', not under a todo-specific action, and TODO-RPC-003 pins that. Each new class also asserts it is actually listed in its module providers, since a decorated class nobody registers is invisible to discovery and answers PERMISSION_DENIED with no other symptom.	2026-08-09 13:24:58 +02:00
Maurice	9b3d37ea29	Move the tags plugin surface onto the decorators ... Wires the registry into the host and takes the first domain across, so the kit lands with a worked example rather than as scaffolding nobody uses yet. The registry is an additive, optional fourth constructor parameter on PluginRpcHost, so all 107 existing construction sites keep compiling untouched; that is what makes the rest of the rollout a per-domain move instead of a big-bang one. bindInto runs LAST in the constructor, so a method still owned by one of the has() blocks collides loudly instead of being silently overridden. tags is the right pilot: four methods, a service that is already DI-native, and it exercises the read/write permission split, the userless refusal and a BadParams write. Handler bodies and messages are verbatim; only deps.foo(...) became this.tags... and uid became ctx.actingUserId. dispatch now strips the supervisor's _inv marker. The supervisor resolves the acting user from it before dispatch and then passes the request on untouched, so it has been visible to every handler and is in effect a reserved param name. Nothing reads it: auditResource takes named fields only, and the one handler that touches the params object as a whole (packing.setBagMembers) reads a named field off it. Dropping it keeps a future strict parse from rejecting calls every shipped plugin makes. Two tests carry the rollout from here. rpc-coverage.test.ts derives both owner sets from the code and proves they partition the method vocabulary exactly, so a PR that moves a method and forgets to delete the legacy registration fails in CI. And because a decorated class that no module registers is invisible to discovery, with every call to it coming back PERMISSION_DENIED and no other symptom, tags.rpc.test.ts asserts TagsRpc is actually listed in providers.	2026-08-09 11:58:56 +02:00
Maurice	f0f69df67e	Fold the journey domain into Nest and finish the MCP migration ... journeyService (1324 LOC, 36 exports) and journeyShareService (203) become JourneyDomainService and JourneyShareService. Every SQL statement, error string and broadcast is the one that shipped. The two could never be split: the share service gates on isOwner, which lives in the domain service, so it injects it. JourneyDomainModule is a leaf carrying just the two services. Places, assignments and the plugin host each need a handful of journey functions; importing JourneyModule for that would drag MemoriesModule and both photo providers into their graphs. Same shape as TrekPhotosModule. The 23 tools in src/mcp/tools/journey.ts become JourneyMcp. src/mcp/tools/ is down to _shared.ts and registerTools() no longer fans out to anything. journey.bridge.ts keeps four exports, for the journey resources in src/mcp/resources.ts that register at import time. McpAccessMode is host-augmentable now. journey:share is neither read nor write, so the three share tools would have had to be opaque predicates - and predicates bypass the access policy entirely, invisible to the boot-time scope gate. A scope typo in one would ship as a silently ungated tool. McpAccessModeRegistry mirrors McpAccessGroupRegistry; unaugmented, mode stays 'read' | 'write'. Fixes a latent bug in tests/helpers/mcp-test-controllers.ts: it constructed PlacesService with five of eight arguments. tsconfig only includes src, so nothing typechecked it, and the missing dependencies were harmless until the journey skeleton hooks landed on the place write paths. journey.mcp.ts arrived from src/mcp/ at 14.5% branch coverage - the legacy registrar had no test file of its own. 40 tool tests take it to 93.4%, and 25 cases for the skeleton lifecycle, the photo gallery and the preference row take the domain service from 73.9% to 82.8%.	2026-08-08 23:25:57 +02:00
Maurice	3efedd5e48	refactor(server): decorate the last three MCP prompts ... The prompts registrar is gone. Each prompt moves to the domain that owns its data instead of a shared file that had to import three bridges to serve them. packing-list goes to PackingMcp and budget-overview to BudgetMcp, both reusing the `when` addon gate their tools already carry — so a disabled addon keeps the prompt out of the listing, exactly as the `if (isAddonEnabled(...))` around the registration call did. Both keep taking the trip title through trips.bridge: TripsModule imports PackingModule and BudgetModule, so injecting TripsService would close a cycle. Same documented in-container exception as atlas.mcp.ts, and the registrar reached for it the same way. token_auth_notice goes to a new AuthMcp — it is a statement about how the session authenticated, not about trip data, and it injects nothing because the message is static. Its `if (isStaticToken)` guard becomes `when: (ctx) => ctx.isStaticToken`; the registry hands `when` the session context, so an OAuth 2.1 session never sees the prompt listed at all, which is what the registrar achieved by skipping registration. src/mcp/tools/ is down to _shared.ts and journey.ts. journey stays until services/journeyService folds, which waits on memories.	2026-08-08 21:20:36 +02:00
Maurice	cacab0795f	refactor(server): decorate the weather, airport and transport MCP tools ... Three of the four remaining hand-written registrars are gone. The tools keep their names, descriptions, input schemas, annotations and result shapes; the registration-time scope gates (`if (canWeather)`, `if (canGeo)`, `if (!canWrite(scopes, 'reservations')) return`) become declarative access markers, resolved by trekMcpAccessPolicy like every other decorated domain. get_weather / get_detailed_weather move into a new WeatherMcp over the injected WeatherService, including the catch that answers with the upstream message and isError rather than throwing - a client sees "Weather service not available." instead of a transport failure when the provider is down. search_airports / get_airport move into a new AirportsMcp with no injected service at all: the airport table is a static dataset. AirportsService owns the flight-endpoint backfill against the database, which neither tool touches. create/update/delete_transport move into ReservationsMcp rather than a domain of their own, because a transport IS a reservation - same table, same service, same reservation_edit permission - and that class already injects everything they needed from the four bridges the registrar was importing. That was budget.bridge's last outside-container consumer, so linkBudgetItemToReservation is pruned with it; the file is down to one export and dies as soon as BudgetMcp stops needing AuthService. journey.ts stays: it still reaches into services/journeyService, which cannot fold until memories does.	2026-08-08 21:20:36 +02:00
Maurice	ac96644508	refactor(server): fold the notifications domain out of services/ ... Four files taken apart rather than moved, because they only worked as a knot. The mailer becomes its own leaf module. AuthService sends the password-reset mail while NotificationsModule imports AuthModule for the demo gate in NotificationsMcp - a mailer inside the notifications domain would have closed a hard cycle that only a forwardRef could open again. Webhook and ntfy stay with notifications; auth has no business importing them. The channel registry stays a module singleton and does NOT become a provider. PluginRuntimeService pushes its channel getter in at onModuleInit, and notifications.bridge.ts builds its own NotificationsService for the scheduler crons and the memories senders. A provider would hand the bridge a second, empty registry - every plugin channel would then go quiet with no error anywhere. CHOVR-015 drives that seam end to end: a channel published through the runtime, delivered through the bridge. Nothing pinned it before; the existing cases all set the source themselves. The built-ins no longer self-register by side-effect import. They used to exist only because notificationPreferencesService happened to `import './notifications/builtins'`; removing that line would have silenced email, webhook and ntfy without a failure. They are built from the injected transports and registered from NotificationsService's constructor, so both instances have them. No cached nodemailer transport: MailerService.createTransport re-reads the SMTP config and skipTlsVerify per send, exactly as the three inline call sites did, so an admin changing them does not have to restart. Preferences become a provider over DatabaseService. Eight places built NotificationsService by hand, so a tests/helpers/notifications.ts factory keeps the next constructor parameter a one-file diff instead of an eight-file one.	2026-08-08 12:09:56 +02:00
Maurice	939452f9d8	refactor(server): consolidate trip access and fold the query helpers into the container (#1824) ... * refactor(server): route every trip-access check through DatabaseService Twelve Nest services carry the same verifyTripAccess/canEdit pair. Six already asked DatabaseService.canAccessTrip; the other six went through services/tripAccess, a nine-line re-export of the identical function. Same query, same result, two ways to reach it. All twelve now take the injected route, so services/tripAccess is gone. The bigger duplication was in the types. Thirteen files declared their own `Trip` for the same return value, in three different shapes: NonNullable<ReturnType<typeof verifyTripAccess>> 6x { user_id: number } 4x TripAccess 3x The narrow one is why assignments, days, places and accommodations all wrote `as Trip | null | undefined` on the call — the cast existed to shrink TripAccess down to a local type that was never meant to differ from it. All thirteen now say TripAccess, and the four casts are gone with no other change. middleware/tripAccess.ts goes too: it was already dead in production — nothing under src/ imported requireTripAccess or requireTripOwner, only comments in the services that had absorbed them. Its test went with it. * refactor(server): fold the query helpers and trip joins into the container Two more legacy files whose only reason for staying outside the container was that they predated it. services/queryHelpers.ts held five exports doing two different jobs. Three are the batch loaders that keep the list endpoints off N+1 queries — they hit the database and are now QueryHelpersService over the injected connection, imported by assignments, days, places and share. The other two, formatAssignmentWithPlace and ratingAggregate, touch no database at all; they sat next to the loaders only because the loaders were free functions too. Those stay free functions, in common/rowShape.ts. The README note on the assignments service claimed the loaders had to stay in services/ because the day, share and place services were unmigrated. All three have since moved, so the reason is gone. services/tripMembership.ts becomes TripMembershipService in its own module. It could have folded into auth or trip-invite, but both call it — as do oidc and the plugin RPC host — and putting it in either would have made AuthModule and TripInviteModule import each other. Neither module is @Global, matching PermissionsModule: e2e TestingModules resolve them transitively through each consumer's explicit import. Test seams changed shape accordingly. Two path mocks of services/tripMembership became injected stubs; the trip-invite e2e overrides the provider in the container instead. The oidc test keeps the real implementation, which is what OIDC-SVC-045 was always asserting. ratingAggregate moved out of the ungated services/ tree into the coverage-gated one, so it gets the direct tests it never had — as does the tags/participants pass-through, which two long-dead fixture variables in the moved test file had been waiting for. Also drops four stale comments that outlived their subject: the requireTripAccess middleware they pointed at was deleted in the previous commit.	2026-08-07 16:00:12 +02:00
Maurice	6dda05f672	refactor(server): move the stateless helpers into nest/common (#1823) ... Eight files in services/ hold no state and touch no database: avatarUrl, conflictResult, demo, passwordPolicy, timezoneService, cookie, and the two crypto helpers. They are imported from 65 places, 62 of them already inside src/nest, so having them live in the legacy layer was pure inertia. They stay plain functions rather than becoming providers. Three importers sit outside the container and would have no way to reach an injectable one: db/migrations.ts runs before the app is built, and middleware/auth.ts and middleware/mfaPolicy.ts run beside it. Wrapping these in DI would buy ceremony and nothing else. mfaCrypto and apiKeyCrypto move together into common/crypto — they read the same ENCRYPTION_KEY, and the directory says so. services/ drops from 44 files to 36, 9,870 lines to 8,493. One trap worth recording: src/app-config and src/nest/app-config both exist. cookie.ts imported '../app-config' from services/, which resolved to the former; after the move the same string silently pointed at the latter, which has no readEnv. It is now explicit about which one it wants. Nothing else changes — no signatures, no behaviour, no tests rewritten beyond their import paths.	2026-08-07 15:14:14 +02:00
Maurice	e606ebd9b9	chore(server): pin the WebSocket envelope, dedupe the rate limiter (#1803) ... * chore(nest): register LlmParseModule in AppModule The module was only in the container because BookingImportModule and PluginsModule happen to import it, so /api/admin/llm/local depended on those two keeping that import. Register it where every other module is registered. * refactor(nest): give the rate limiter one home and one instance RateLimitService keeps its counters in a Map on the instance, but it was listed in the providers of auth, oauth, transit and trip-invite, so each of them got its own. Nothing is broken today — the bucket names in use (login/mfa/forgot/reset, oauth_*, transit_*, trip_invite) don't overlap — but two modules picking the same name would have quietly allowed twice the configured attempts. Move it to nest/common, where it belongs now that four domains use it, and hand it out through a small module they import. Not @Global: the e2e suites build a container around one domain module, so a global AppModule never pulled in isn't there at all. transit.mcp.ts keeps its own instance on purpose — it keys by userId under mcp_transit_* while the REST path keys by IP. * test(ws): pin the wire envelope before touching the transport Every frame on the socket is flat: {type, tripId, ...payload} out, {type, tripId} in. Nest's WsAdapter dispatches on message.event and answers {event, data}, so moving this onto a gateway without a custom serialiser would leave join silently unhandled — no welcome.socketId to send back as X-Socket-Id, and every client would then receive its own writes. Nothing catches that today: the 100+ tests that touch realtime mock src/websocket and never look at the bytes. WS-032 sends the exact shape the stock adapter would and asserts the server ignores it. * docs(nest): drop the parts of the README that no longer exist strangler.ts, DEFAULT_NEST_PREFIXES/NEST_PREFIXES and tests/parity/ are all gone — every request goes through Nest now — but the README still walks a new contributor through adding a prefix and writing a parity test against the Express route. Also spell out that the 80% gate is an average over src/nest/**, not a floor per file, so a large untested module can sit behind the well-covered small ones.	2026-08-06 22:44:59 +02:00
jubnl	d203d8cccd	chore: move notifications backend to proper DI ... The send() dispatcher (services/notificationService.ts) and the in-app store (services/inAppNotifications.ts) fold together into the DI-native NotificationsService over DatabaseService + RealtimeService; the prefs matrix, transports, channel registry and inAppNotificationActions stay plain infra modules. A 1-export notifications.bridge covers scheduler, legacy adminService/memories and the six lazy fire-and-forget sends; AdminController and the plugin RPC host (24th factory dep) inject. The 5-tool registrar + notifications-in-app resource move to notifications.mcp.ts. Tests move with case IDs preserved (NSVC-*, INOTIF-*, + NSVC-020 bridge pin); ~18 suites repoint path mocks/warm-ups; the module e2e goes DI-native. Also carries the verified-quirk fixes that would normally trail as a separate fix(server) commit (file-overlap with the fold): toUtcIso on all three created_at paths (INOTIF-013/014), respond claims the response CAS before running the action handler with release-on-failure (INOTIF-011/012), synology's fire-and-forget send gains .catch, the dispatch-failure log unwraps Error messages (NSVC-021), and the MCP resource description drops its false 'unread first' claim.	2026-08-02 11:36:06 +02:00
jubnl	e65f851446	chore: move passkey backend to proper DI	2026-08-02 10:10:33 +02:00
jubnl	45564b0a8a	chore: move auth backend to proper DI ... Fold the 1497-line services/authService.ts into the DI-native nest/auth domain (Wave-5 chain opener, unblocked by the atlas fold): - Pure crypto half (backup-code hash/match/generate, stripUserForClient, key masking, the import-time DUMMY_PASSWORD_HASH timing equaliser and avatarDir mkdir — documented parity exceptions) moves verbatim to the plain module nest/auth/auth.helpers.ts. - DB half folds into AuthService over DatabaseService + injected PermissionsService (ex permissions.bridge) + AtlasService (ex atlas.bridge, deleted on schedule). mfaSetupPending and the per-email reset throttle stay module-scoped so the bridge and container instances share them; avatarDir and require('../../../package.json') re-anchor one directory deeper — with the two injection swaps, the only non-verbatim lines. Controller-facing method surface unchanged. - New 8-export auth.bridge.ts for out-of-container consumers: mcp/index.ts token verification, the journey/notifications/transports registrars' isDemoUser, and the still-legacy adminService/oidcService/passkeyService. - 15 domain *.mcp.ts demo guards now inject AuthService (their modules import AuthModule); atlas.mcp.ts alone stays on the bridge because AuthService injects AtlasService and the reverse module edge would close an AuthModule<->AtlasModule cycle (places.mcp precedent). OidcService and PasskeyEnabledGuard inject AuthService too. - Tests move with case IDs preserved: authService.test.ts -> auth.helpers.test.ts, authServiceDb.test.ts -> auth.service.test.ts (+ AUTH-BR-001..007 bridge delegation, + AUTH-DB-050..088 pinning the previously untested getAppConfig/login/MFA/reset/admin-settings branches now under the src/nest coverage gate). auth.e2e converts DI-native (real bcrypt, real audit rows); oidc.e2e swaps its dead path mock for an instance spy; websocket/integration suites repoint to bridge/helpers. Quirks preserved byte-for-byte (0-coord drop in getTravelStats, un-transactioned registerUser/verifyMfaLogin multi-writes, unguarded revokeUserSessions in deleteMcpToken, current! assertions in updateApiKeys) — fixes land separately.	2026-08-01 17:39:59 +02:00
jubnl	ae3ba18b9e	chore: move atlas backend to proper DI ... Fold the 1612-line services/atlasService.ts into the DI-native AtlasService: the stats aggregation, visited countries/regions with the #1490 tombstone and cascade logic, and the bucket-list CRUD become methods over the injected DatabaseService. The ~750-line pure-geo half — the bundled admin0/admin1 boundary stores with their #1576 streaming builders, the point-in-polygon indexes, Nominatim geocoding with its shared throttle, and every module-scoped cache including the import-time unref'd cleanup interval — moves verbatim to the plain module atlas-geo.ts so the caches stay process-global across the container instance, the bridge instance and test helpers (assetPath re-anchored one directory deeper, the only non-verbatim line). The 10-tool mcp/tools/atlas.ts registrar plus all four atlas resources in mcp/resources.ts move onto the decorator registry as atlas.mcp.ts — the when: atlas-addon gate is parity here (legacy tools and resources both gated; the REST controller deliberately does not). resources.test.ts retires with its last two cases, which move to tools-atlas-expanded.test.ts. The plugin RPC host swaps its 9 atlas imports for the injected AtlasService (23rd constructor dep); a minimal 2-export atlas.bridge.ts serves the one legacy consumer, authService.getTravelStats, and dies when authService migrates. Adopts atlas.dto.ts over the existing shared schemas and clears all three AtlasController entries from body-contract-allow-list.ts: the hand-rolled 'name and country_code are required' 400 becomes the ZodValidationPipe envelope (todo/places trade) while the whitespace-only bucket name keeps its legacy 'Name is required' trim guard. Fixes the verified defects the relocation had faithfully carried, each with a regression test (ATLAS-SVC-031..036 plus two MCP casing cases): the four multi-statement mark/unmark writes now run in db.transaction() (the region cascade nests as a savepoint), the trip-less countryPlaces early return honours manually_marked, the '|| null' bindings that dropped lat/lng 0 and empty-string notes on bucket update become '?? null', the mutating bucket SQL is user-scoped, and the MCP region/country-places tools uppercase their codes to match REST. Quirks deliberately preserved: the detached GET-path place_regions backfill writes, getStats' two divergent return shapes, the import-time cache-cleanup interval, getCountryFromAddress's unvalidated bare 2-letter codes, and the whitespace-only-name silent no-op on bucket update. Tests move with their case IDs: atlasService.test.ts becomes unit/nest/atlas.service.test.ts (pure-geo imports from atlas-geo, DB calls through the constructed service, plus bridge-delegation cases), the atlas e2e converts to the DI-native pattern (real SQL against the full temp-db schema), and the plugin-host path mock becomes a constructor stub.	2026-08-01 15:50:36 +02:00
jubnl	cab49ea511	chore: move collections backend to proper DI	2026-08-01 13:54:19 +02:00
jubnl	4f0f80ad69	chore: move place backend to proper DI ... Fold the 1029-line services/placeService.ts into the DI-native PlacesService: the CRUD + ratings SQL, the GPX/KML/KMZ importers and the Google/Naver list importers become methods over the injected DatabaseService, byte-identical statements, COALESCE semantics and the If-Match conflict protocol (#1135). The pure half — frozen XML parsers, the KMZ unpacker, the dedup predicates, the Google hex-id parsers, reclaimPhotoCache — moves to places.helpers.ts (maps.helpers precedent). The 10-tool mcp/tools/places.ts registrar plus the trek://trips/{tripId}/places resource move onto the decorator registry as places.mcp.ts. search_place travels with them because its gate is places:read, not the read-only geo group, and now injects MapsService. TripsService, DaysMcp, BookingImportService and the plugin RPC host (PluginHostDepsFactory's 21st constructor dep) all inject PlacesService, so the domain needs no bridge at all. The two assignments.bridge imports that places.mcp.ts keeps are a deliberate cycle break: AssignmentsModule imports DaysModule and DaysModule now imports PlacesModule for days.mcp.ts's place creation, so injecting AssignmentsService there would close DaysModule -> PlacesModule -> AssignmentsModule -> DaysModule. Same seam reservations.mcp.ts uses, same trade trips.bridge.ts documents. Also folds services/placeEnrichment.ts in — its DB/websocket/Maps half becomes PlacesService methods over the injected DatabaseService/RealtimeService/ MapsService, its pure match selector joins places.helpers.ts — which retires nest/maps/maps.bridge.ts with its last consumer. Adopts places.dto.ts for the seven grandfathered body contracts and clears every PlacesController entry from body-contract-allow-list.ts. Two consequences worth knowing: the bespoke 400s 'Place name is required', 'ids must be an array of numbers' and 'URL is required' are now the ZodValidationPipe envelope, and because a pipe runs before the handler a malformed body 400s ahead of the trip-access 404 it used to follow — the same trade the todo and trips migrations took. placeBulkUpdateRequestSchema.ids drops .min(1) so the endpoint's empty-list short-circuit stays reachable. Fixes four defects the relocation had faithfully carried, each with a failing-first regression test: - create dropped lat/lng of exactly 0, so a place on the equator or the prime meridian lost its coordinates (`x || null` cannot tell absent from zero). - duration_minutes: 0 was unsettable — replaced by the 60-minute default on create, and read as "absent" by COALESCE on update. - the journey delete hook fired on unscoped ids: DELETE /:id, POST /bulk-delete and the delete_place MCP tool could detach another trip's journey entries for an id they then refused. All three scope first via the new PlacesService.scopedIds, mirroring the guard PluginHostDepsFactory already had. bulk_delete_places also moves its hook ahead of the DELETE — journey_entries.source_place_id is ON DELETE SET NULL, so running it afterwards left the entries as orphans. - the place search treated % and _ as LIKE wildcards; a bare % returned the whole trip. The three clauses now carry ESCAPE with the term escaped. Plus hardening on the Google list fetch: the response is capped at 8 MB (declared content-length and post-read length, the transit.service precedent) and its JSON.parse is guarded, so a malformed provider payload produces the existing 'Invalid list data received from Google Maps' 400 instead of throwing. Quirks deliberately preserved: the non-COALESCE route_color (#776), currency/transport_mode staying unclearable, importGpx returning null for a file that parses but yields no usable geometry, update skipping the If-Match check when the stored updated_at is null, and every string-valued `x || null`. Tests move with their case IDs: placeService.test.ts and the wrapper suite merge into unit/nest/places.service.test.ts, kmzUnpack into places.helpers.test.ts, placeEnrichment into places.enrichment.test.ts. The places e2e converts to the DI-native pattern (real SQL against temp-db DDL), tools-places.test.ts is kept and extended so it exercises the decorator path through the test registry, and the plugin-host and booking-import path mocks become constructor stubs.	2026-07-30 17:07:12 +02:00
jubnl	f4bf7cf3dc	chore: move transit backend to proper DI ... Includes the quirk-repair pass (upstream timeout + size cap, LRU cache, NaN-duration guard) that maps landed as a sibling fix commit.	2026-07-29 21:39:51 +02:00
jubnl	2e40c19249	chore: move maps backend to proper DI	2026-07-29 20:20:57 +02:00
jubnl	287dceb532	chore: wire TripsService into the plugin RPC host and retire the legacy tripService ... Swap the factory's six tripService imports for the injected TripsService; delete services/tripService.ts and the collab/vacay bridges with it; prune the days/budget bridges to their surviving exports; update the migration docs and regenerate migration-graph.md.	2026-07-29 01:53:54 +02:00
jubnl	530c7cb005	chore: move trip backend to proper DI ... Fold the legacy tripService SQL into TripsService; port the trips MCP registrar/resources/trip-summary prompt to trips.mcp.ts and the share-link tools to share.mcp.ts (predicate access for the trips:delete/trips:share/canReadTrips gates, deprecation notice via the attach ctx); adopt trips.dto.ts and clear the seven allow-list entries; delete todo/share bridges with their last consumers. Includes the trailing quirk fixes: transactional deleteTrip/deleteGuest, owner display_name in listMembers.	2026-07-29 01:53:40 +02:00
jubnl	a2861d40f3	feat(server): injectable RealtimeService over the ws singleton ... Nest services inject RealtimeService (call-time delegation to the websocket module, DatabaseService pattern) instead of importing broadcast/broadcastToUser globals. Zero behavior change; test edits are constructor-arg additions plus RealtimeModule in e2e harness imports only.	2026-07-29 00:07:51 +02:00
jubnl	65fb00d63b	feat(server): type MCP access groups against SCOPES + boot gate	2026-07-28 20:56:43 +02:00