157 Commits

Author	SHA1	Message	Date
Maurice	e753603ec8	test(db): re-point the trailing-migration guard at the new last slot ... The guard proves that a migration appended to the end still runs on an install that is one version behind, by undoing what the last one did and replaying it. Its own comment asks whoever appends the next migration to re-point the undo, which is what this does: the trailing slot now clears the GB rows out of place_regions rather than creating journey_books. The Spanish row alongside it is there to catch the opposite mistake — a migration that clears more than its own country.	2026-08-20 18:40:26 +02:00
Maurice	eae8480728	feat(studio): follow-ups from using Studio on a real journey (#1984) ... * feat(studio): widen the document, and stop a save from losing it The schema gains what the elements coming after it need: an icon element, a badge that can be restyled rather than only placed, a date and a pair of coordinates on a text binding, and the map's route, pin and road settings. Widening it turned up two ways a book could fail to come back. The mood badge writes its code into the document, and the schema said that code was exactly two characters, from a first draft where it was a country. The real codes are words, so every save was rejected and the read that followed parsed to an empty document: seventeen spreads in, nothing out. Widened to what the badge actually writes, and normalizeBookDocument now drops the elements it cannot read rather than the whole book, so one bad element costs a picture frame instead of a year of work. The other was the body limit. The parser allowed 100kb for everything, and a book with a routed map measures past that, so the save came back 413 and the editor sat on "not saved" with no way forward. Book writes get their own parser at 8mb; everything else keeps the limit it had. * feat(studio): a date, a pair of coordinates and an icon library Three things that had to be drawn by hand before. A journal entry knows when it happened and where, and neither could be put on a page: you read the date off the entry and typed it into a text box, where it then stayed while the entry moved. Both are chips now, next to the title and the story, and both follow their entry the way the others do. The formatting lives in one place so the chip, the template and the resolver cannot drift by a character — coordinates in degrees or decimals, the date in the reader's language. The icons are the whole Lucide set, searchable, placed as a real element with its own colour and stroke rather than as a character in a font. The stroke is deliberately not called strokeWidth: three separate places rescale a field of that name by page width, and an icon whose line thins as the book grows is not what anyone asked for. And the badges finally have their settings. A mood or weather badge could be placed and then only moved: the icon's colour was fixed, the icon could not be turned off, and there was no way to keep the icon and drop the words. All three are switches now, with the colour following the badge unless you say otherwise. * fix(studio): let a placed entry field follow its journal entry again The inspector says a bound field follows the journal entry and that editing it here breaks the link. The first half was not true: nothing ever re-read the entry, so renaming a title in Journey left the old words on the page for good, and the same went for every other bound field. The resolver runs where the journey is loaded and re-reads the fields that still point at an entry. What it will not do is as important as what it does. A field somebody has typed over stays typed over, an entry that is gone leaves its element alone rather than blanking it, and an entry that answers with nothing never wipes what is already on the page. Formatted fields — the date, the coordinates — are only re-read when the format itself changed, which is what keeps this from quietly rewriting books that already exist: an entry whose date was placed as a heading and then set in capitals keeps its capitals. Checked against the real database before it shipped, where the first version overwrote three of them. * feat(studio): start a new book empty, with six layouts to choose from A new journey opened onto a book that had already been laid out, which is the wrong first move: it decides the shape of somebody's book before they have seen it, and undoing it means deleting pages one at a time. A new book starts empty now, and the auto layout runs when it is asked to. The layouts themselves went from two to six, so choosing one is a real choice: what was there covered a photo-heavy spread and a text-heavy one and nothing in between. * fix(studio): hyphenate the export the way the editor does, and set the bleed Two things the press sees and the editor did not. A paragraph broke in different places in the PDF than on screen. The print document is written from scratch and never carried a language, so the browser hyphenated the editor's German and the export's nothing-in- particular. It takes the page's own language now. The wait for the sheet to be ready also covers the images inside SVG, with a ceiling, so a map that is slow to draw does not print half-finished. And the bleed and the safe margin are typeable. Both were baked into every page preset at what a photo-book vendor usually asks for, 3mm and 5mm, with no control anywhere. That is fine until a printer asks for 5 and 10, at which point the book cannot be made here at all: the export carries the wrong bleed and the crop marks sit in the wrong place, which nobody finds until the guillotine has run. * feat(studio): rebuild the inspector The panel on the right had grown by accretion: every element type had added its own controls in whatever shape suited it that day, so the same idea — a colour, a size, a toggle — looked different depending on what you had selected, and long panels were a wall of unlabelled fields. It is one set of controls now, used by every element: foldable sections, a line that holds a label and its control, radio choices, checkboxes, the app's own toggle, and a number field that holds a draft so typing "500" is not read as "5", clamped and written back under the cursor. Duplicated controls were merged rather than deleted; nothing an element could do before it cannot do now. The head carries the element's identity and its actions, so what you have selected is readable without counting fields, and the sections have room to breathe: what was there was correct and unreadable. * feat(studio): a route map worth printing The map in a book was a straight grey line between grey dots on a tile that was chosen for a screen. At print size those tiles are read at roughly four times the resolution they were fetched for, which is why it looked soft next to everything around it. The imagery comes from sources that hold up on paper: NASA's shaded relief and EOX's cloudless Sentinel-2, both licensed for it, picked at a zoom that matches the printer rather than the screen. Tiles are fetched at twice the density where the source offers it, and the seam between them scales with the tile instead of sitting at a fixed fraction of a millimetre, which under editor zoom fell below one device pixel and showed as white threads. The route is drawn rather than plotted. A leg that was never recorded bows, by an amount that grows with its length and turns away from the pole, and it dashes, because an inferred line should not claim to be a track — a recorded track never bows. Both strokes are laid down in two passes, casing then core, so the line stays legible over dark sea and bright desert alike. Legs can follow roads instead, routed leg by leg with the geometry thinned before it is stored, which is the setting a road trip wants and the one a flight cannot have. Stops carry their own first photograph, cut to a circle by a stencil that exists — the first one was written into a defs block that only appears on a map clipped to a coastline, so on an ordinary map it clipped nothing and the photographs sat square on the page. A stop with no photograph of its own is numbered rather than handed one from elsewhere in the journey: a marker at one place showing a picture taken at another is a caption that lies. Whatever the frame, the whole route is inside it. The window takes the frame's aspect, so the fit and the imagery agree instead of one containing what the other covers, and a map dragged narrow no longer cuts off its end. Each linked trip can carry its own map, and a map notices a photograph added to a stop afterwards rather than having to be placed again. * i18n(journey): the new Studio strings, in all 23 locales * test(journey): pin the coverage the map work brought with it The journey domain measures higher than its floor after this round, so the floor follows it up. Only journey moved; the generator's suggestion would have taken memories' functions down a point, and a ratchet that can fall is not a ratchet. * test(studio): cover the thinning that keeps a road route saveable The one path in roadRoute nothing exercised, and the one that matters most: a router answers a long drive with thousands of points at a precision no press can resolve, and all of it goes into the document. Keeping a leg whole is what pushed a real book past the body limit. Both ends have to survive so the line still meets its stops, and the spacing has to stay even, because cutting a run out of the middle would straighten exactly the bends somebody wanted to see.	2026-08-20 15:43:27 +02:00
Maurice	736599a89b	feat(journey): TREK Studio — a photo book designer for Journey (#1973) ... * fix(photos): serve local photos root-relative so a dotted install path works res.sendFile(absolutePath) resolves against the rewritten req.url under the Nest ExpressAdapter and answers a spurious 404 even though the file is there — the same trap files-download.controller.ts:60 and plugin-frame.controller.ts:74 already work around with an explicit { root } + basename. The photo resolver never got that treatment, so every thumbnail and original 404s on any install whose uploads path contains a dot segment (~/.local/share/trek and friends). The public journey asset route had it too, which took shared journeys with it. The guards above each call already confine the path to the uploads tree, so the root form is no weaker than what it replaces. * feat(shared): add the book document contract for TREK Studio Millimetres throughout, not pixels: a pixel means nothing to a print shop and changes meaning with the device pixel ratio. CSS maps 1in onto 96px, 25.4mm and 72pt with a fixed ratio, so the editor can render the document at a scale and the print renderer at 1:1 and land on the same page. Paint order is the array order rather than a zIndex field that can disagree with itself, text elements may stay bound to the journal entry they came from, and a spread can park content a layout has no room for instead of dropping it. * feat(journey): open TREK Studio over the journey Studio is a child route of /journey/:id and portals itself above it, so the journey stays mounted and shows through the panel's 16px margin — it reads as something opened on top of the journey rather than a place you navigated to. The URL exists for reload, the back button and shared links; the user never sees it. Every rule in studio.css is scoped under .trek-dash on purpose: dashboard.css:95 resets button font, colour, background and padding at a specificity a bare .st-x loses to, so an unscoped rule silently does not apply to a button. Escape clears the selection and only leaves on a second press. In a dialog Escape means go away; in an editor that reflex would cost you the page. * feat(journey): build, edit and arrange the book in Studio The auto mode turns a journey into a book once and then gets out of the way: what it produces is an ordinary document, every element as editable as one placed by hand. Templates work the same way — applying one pours the spread's existing photos and text into the new arrangement and parks whatever will not fit, so trying a text-only layout does not cost you the pictures. Moving and resizing are hand-rolled on pointer events. The drag-and-drop libraries in this space move items between lists and have no notion of a free frame, a handle or a magnetic edge; HTML5 drag hands you a ghost image you cannot control and no position until the drop. It is used for exactly the one shape it suits — dragging a photo out of the content panel onto a frame. Selection chrome carries two rings, dark inside light. A single line vanishes against a photograph of its own value, and over a picture that is bright on one side and dark on the other no measurement of the background can be right. The sheet renders in DOM rather than on a canvas so the same component tree can be what the print renderer runs — one renderer, nothing to drift against. Edit affordances live in a layer above it and can never reach the page. * i18n(journey): studio strings across all 23 locales The empty-frame prompt breaks per language rather than copying the English line break onto everything — forced onto Japanese or Arabic it strands a fragment on the second line. * refactor(journey): keep SpreadView to components only FONT_STACKS and photoSrc move to their own module: a file that exports both components and constants breaks Fast Refresh, and this is a file you edit constantly while designing a page. Types come from the journey store instead of any, and the count beside the content tabs is a badge rather than competing with the label for the same weight. * feat(journey): more shapes, decoration and a content search in Studio Six shapes now instead of three — rounded rectangle, triangle and an outline-only box join the rest, plus a quotation mark and an outlined circle under decoration. A triangle is a clip path rather than the old CSS border trick: that hack cannot take a fill gradient or a stroke and its size does not follow the frame the way everything else does. A stroke sits inside the frame, or the drawn shape would be wider than the box the editor snapped and the print would not match it. The content panel gets a search over photos and entries. A photo matches on its own caption and on the entry it hangs from — most photos carry no words at all, so matching captions alone would look broken on exactly the journeys that need it. Plain filtering over what is already in memory; a journey holds tens or hundreds of items, not thousands. Dates in the panel and in the book now follow the app's language through the house formatDate rather than the browser's locale, and the entry's date and place are two badges instead of one dot-joined string the eye has to parse. * @ feat(journey): a shape library, picture frames and photo grids for Studio Studio had six shapes, two frames and no grids. This is the library that makes it usable for a book rather than for a diagram. Shapes are SVG paths now, not clip-paths. That was forced rather than chosen: a clipped div cannot take a stroke — the clip cuts the border in half lengthwise — and a heart is not a box with a radius. Rectangles and ellipses keep their old div rendering, since a box genuinely is better as a box and every document written so far contains those two. Two decisions in shapes.ts are worth stating. The path *points* are scaled, not the coordinate system. Fitting a path with preserveAspectRatio="none" scales the stroke with it, so a 0.5mm outline on a frame twice as wide as it is tall comes out 0.7mm on the sides and 0.35mm top and bottom. Printed next to a straight rule at 300dpi, you see it. Hence the deliberately boring path subset: absolute M/L/C/Q/Z, numbers alternating x and y, no arcs. And every shape fills its 0..100 box exactly, enforced by normalise() at module load rather than asked for in a comment. The editor draws its selection outline, its resize handles and every snap target from the element frame, so a shape occupying 86% of its own frame cannot be aligned against anything you can see. It costs a regularity nobody can spot — a hexagon in a square frame still reads as a hexagon. Frames are the same list: a picture frame is a shape with a photograph inside it, and keeping two would mean a heart that exists as one but not the other. Photos gain a mask and a decoration, kept independent, plus the Polaroid, film and tape treatments that are not expressible as either. Grids take their gutter out of the cells rather than adding it between them, so a grid asked to fill the safe area fills it instead of overhanging by one gutter. @ * @ feat(journey): derive what a journey adds up to GET /api/journeys/:id/stats — distance, days, steps, photos, places, the furthest point, the countries in visit order, and the route itself. Read only and derived: nothing here is stored, it is what the trips added to the journey come to. The route comes from the journey entries where they carry coordinates, and falls back to the places on the linked trips where they do not — which is the common case for a journey assembled from trips nobody has written up yet. The two are never mixed: an entry written about a place that is also on the trip would be two stops at one location, and the distance would count that leg twice. Countries read place_regions first, which Atlas already fills, and fall through to getCountryFromCoords for the rest. That import is a plain function from a module built without DI or Nest edges, so it costs the journey domain no coupling to Atlas. Distance is great-circle metres, not driving distance: there is no routing engine here, consecutive stops are not necessarily joined by a road, and a book that prints a road distance it never measured is worse than one that says "as the crow flies". Metres because kilometres and miles are a display choice. A hotel across three nights is one place with three day assignments, so the place query aggregates back down to one row at its earliest day — otherwise the route would visit the hotel three times. Two test fixes came out of writing this. journey.controller.test.ts still asserted an absolute path from res.sendFile, which the photo fix in this branch had already changed to the basename-plus-root pair; and linkTripToJourney in the factories wrote to linked_at, a column that does not exist — it had no callers, so it had never once run. @ * @ feat(journey): travel elements — the route, the figures, the countries A photo book of a trip is not an album: the trip carries facts, and those facts make pages photographs cannot. Four new elements — a vector route map, a figures panel, a country page and a set of small marks — plus the mood, weather and pros/cons an entry already records. Every one of them carries its own values, resolved when the element is placed and written into the document. The print renderer is headless Chromium loading a page; one that needs an authenticated fetch to know what it says will print blank the day a token expires. It also makes a book a record of a trip as it was, rather than something that quietly rewrites last year distance when a stop is added. travelRefresh compares what is stored against the journey and offers an update, so bringing an element up to date is a choice. The map is vector, from the coordinates, over silhouettes simplified offline from the admin-0 boundaries the server already bundles for Atlas — no licence question, nothing to fetch at render time, sharp at any print size. It paints no background: a map is geography sitting on the paper, not a window cut through it, so it can be laid over a photograph. Flags are drawn rather than typed. A regional-indicator pair is the obvious answer and works everywhere except Chrome on Windows, which has no flag glyphs and renders the two letters instead — "DE" in a printed book is not a flag. Thirty-three flags are exact constructions; anything with an emblem or unequal bands is deliberately absent and falls back to the country outline, because a wrong flag is worse than no flag. Panel tiles render the real element small, through the page own renderer. These differ from each other by what they say rather than by their shape: four map styles are four maps, and no icon can tell you which is which. @ * @ feat(journey): manage spreads from the pages rail Add, insert between two spreads, duplicate, reorder and delete. None of it existed — a book was whatever the auto layout produced. The cover and the back cover are fixed points: a book has exactly one of each, they are single pages, and no sequence of clicks should be able to produce a book with two covers or none. Every operation asks one predicate whether a spread is inner, rather than each caller testing role for itself, and a spread inserted after the back cover lands before it. Duplicating re-ids every element it copies. Two elements sharing an id would make selection ambiguous and every lookup that follows it wrong, delete included. Also: a locked element can be selected again. Locking used to switch its hit target off entirely, which was a dead end — it could not be picked, so the inspector never showed it, so the unlock button was unreachable and the only way back was undo. Locked now means what it says: it cannot be moved, and its resize handles are hidden so the editor does not offer a drag it will refuse. @ * @ feat(journey): let the auto layout use the travel elements The book now opens on a summary spread — the route drawn on the left, the figures on the right — and, for a journey that crossed a border, a country page after it. Both are omitted rather than left empty when there is nothing to draw: a spread holding a blank frame over the words "0 KM" is worse than a shorter book, and every page in a printed one costs money. Only the figures the journey actually has make it onto the page. A zero is not a fact worth a tile, it is a hole in a composition. Each entry gains a short accent rule above its heading — one drawn element, and the cheapest thing here that makes a spread read as designed rather than as text placed on a page. An entry with no photographs, which is the one spread with a blank left page, sets its date as a numeral there: a gap in the book becomes a pause in it. The back cover closed with `${places} Orte` — German, hardcoded, in a book that follows the app language everywhere else. It is a figures element now, so it takes its labels from the same translations as the rest of Studio. The layout waits for the figures rather than racing them. Laying out first would give a journey a summary spread or not depending on which promise resolved first, and Studio already shows its loading state until the document exists, so the wait costs nothing. @ * @ feat(journey): the Studio wordmark replaces the book-name field The field asked for a second name for something already named after the journey — a box whose only real use was being left alone. The bar says what this is instead: the lockup, inline so it takes the theme ink through currentColor rather than needing a light-on-dark copy, and a beta mark beside it. Along with the strings for everything in this branch, across all 23 locales, and the two keys the name field used, removed rather than left as orphans nobody can tell from live ones. journey.studio.frames was "Picture frames" — too long for a tab sharing a row with two others, and untranslated in 21 of the 23 locales, which showed the English through. It is one word now, in every language. @ * @ feat(journey): a free trim size, page numbers, and auto layout as a button Three from the list the PR left open. **Custom trim.** The five presets are what vendors actually bind, which covers almost everyone — "almost" being the problem. A local printer with a 24x18 press, or a book meant for a particular shelf, could not be made here at all. Two fields under the format list, and typing in them *is* picking custom: a book that is 210 by 240 is not square-21 with a typo, so the preset follows rather than needing to be chosen first. Switching to custom keeps the page it is on — it adjusts the format you have. **Page numbers.** Set on the document and drawn by the renderer, which is the only place that knows what number a page is. Stamping them with pdf-lib afterwards would print numbers the editor never showed, and a book you cannot proofread on screen is not much of an editor. They are also the one thing on a page that is not an element: an element holding "14" would still say 14 after its spread was moved. `startAt` exists because the first inner spread is rarely page 1 once bound, and outer/inner is a real distinction on a spread — getting it backwards puts both numbers in the fold. The controls live in the inspector empty state, which was one line of hint text. With nothing selected, that panel is where the book own settings belong. **Auto layout as a button.** It ran once, on open, which made it the one thing in Studio you could not ask for; a page that came out wrong had to be rebuilt by hand. Now it does one spread or the whole book, both as ordinary commits — the first thing anyone does with a button like this is press it to see, and the second is want their page back. A single spread keeps its id so the rail does not scroll, and refuses on anything not built from an entry rather than replacing it with a blank. @ * @ feat(journey): cover layouts, and five more for the spreads The cover had none. The panel said covers are designed by hand, which was true and unhelpful — it is the page people care most about and the one they had no starting point for. A cover is a different problem from a spread and gets its own set rather than a filter over the existing one: it is a single page, the type is the subject rather than a caption to a photograph, and a spread layout applied to it lands half its frames past the edge. Five of them, from full bleed to type-only, and the panel serves the right set for whichever spread is open. The cards scale as one page there, and drop the fold line, since there is no fold. Five more spread layouts as well — a picture with a narrow column of story, nine up, a mosaic around one large frame, two pictures with the words between them, and four staggered so a row of squares stops reading as a contact sheet. Applying a layout also stopped mangling a single text. The old rule took the longest text as the story and looked for a heading among the rest, which reads a three-text spread correctly and gets a one-text cover exactly wrong: the 30pt title *is* the longest text, so it was the story, so a cover layout with a heading slot and no body slot had nowhere to put it and parked the title. Size decides the heading now; length only sorts what is left. @ * @ feat(journey): seven self-hosted book faces, and a picker that shows them The serif slot was Georgia. Georgia is a system font — on most desktops, on no Linux container — so the print renderer would have substituted something else and a book proofread in one typeface would have printed in another. The existing Journey PDF export has exactly this bug today, asking for Inter while only Poppins is bundled. Every family is self-hosted through @fontsource now, all OFL, all loaded with Studio own chunk so a face cannot arrive after the text has been laid out and reflow the line endings someone was setting. Two sans, three serifs from bookish to high-contrast, two display faces for a cover. Every stack ends in a generic rather than in another named font nobody shipped. The three original ids are kept by name, so documents written so far still parse — they point at bundled faces rather than at whatever the machine happened to have. The picker sets each family in itself. A row of chips reading "Poppins / Lora / Bebas" in the interface font tells you their names and nothing about the only thing anyone is choosing between. Weights a family does not ship are disabled rather than offered: asking for bold on a single-weight display face gets a synthesised one, which prints as a smeared regular. Picking such a family moves the weight to the nearest it really has. @ * @ feat(journey): real map imagery, from the providers TREK already has The map element drew country outlines and nothing else. That is still the default and still the right one — nothing fetched, nothing licensed, sharp at any print size. But an outline of Iceland cannot show which road you took, and some books want that. So two more sources, both reading the tile template and Mapbox token an admin already configured for the planner and Atlas. A second place to paste a token is a second place for it to be wrong, and a source with nothing behind it is not offered at all — showing "Mapbox" to someone without a token produces a grey rectangle and no explanation anywhere. Both costs are stated rather than hidden: tiles are fetched when the page renders, and they are raster, cut for one zoom, so printing much larger than they were fetched goes soft. Attribution is neither optional nor a setting. The licence requires credit and a book is a published work — nobody can add a footnote after it is bound. The credit is matched on the host, so an instance running its own OSM mirror still credits OpenStreetMap, and an unrecognised source gets none rather than an invented one. It is written into the document when the element is placed, so the renderer cannot lose it. The route is projected onto the tile grid when there is one. The vector map fits itself to country outlines, and a line placed by that fit sits next to the road rather than on it — the sort of error that only shows up once it is printed. Outlines are dropped under imagery, where they would be a second coastline over the one in the picture. @ * @ fix(journey): make the Studio type-check again The map element used tileView and projectOntoTiles without importing them, useMapSources declared a stricter frame type than any real frame satisfies, and the mood icon read a colour through an `in` check that types as unknown. The page fixtures in the studio tests predate page numbers, so they build a BookPageSetup that the contract no longer accepts — now parsed from the schema, which cannot drift from it. @ * @ feat(journey): the book is saved Studio laid a book out on every open and kept it in the tab. Close the tab and the afternoon went with it, and the auto layout was not a starting point but the only point. The document now lives in journey_books, one row per journey, and autosaves: quiet for a moment after the last change, or at the latest fifteen seconds in, so a drag across a spread is one request rather than four hundred. A stored book wins over a fresh layout on open, and closing the editor writes whatever is still queued. Everyone on a journey can edit its book, so the write carries the version it was made against and the update matches on it in a single statement. A save that has been overtaken is refused with the current record in the body, which turns "your work vanished" into a choice between two versions. The server broadcasts journey:book:saved to the other editors — the version, not the document — and a client with nothing outstanding takes the new one. A client with unsaved edits deliberately takes nothing and conflicts on its next save instead. @ * @ feat(journey): export the book The one thing Studio could not do. The button was there and disabled. A book now goes out as sheets: every inner spread cut down the middle into leaves in reading order, bleed carried out past the trim on all four sides, crop marks outside that saying where to cut. The cut is a window rather than a re-layout, so a photograph crossing the gutter still meets itself once both halves are printed. Spreads stay whole in the other mode, which is what you send someone to read. The browser makes the PDF, from the editor components at 1:1. Considered and rejected: headless Chromium on the server, and a PDF library drawing the pages a second time. TREK is self-hosted, and neither Chromium in the image nor a second renderer to proofread against is worth carrying when the browser already produces exactly what the editor shows — it is also how the other exports here work. What the browser will not write is PDF metadata and the TrimBox entries; the marks carry that instead, as they have since long before the format existed. Two things had to give. `SpreadView` clipped at the trim, which is right on screen and leaves a white hairline down every edge of a bound book, so print mode lets the page run out and the sheet does the clipping. And the print document is its own document: it carries the app stylesheets across so the seven bundled faces are the ones that print, and waits for images and fonts before it offers to save. @ * @ fix(journey): make the Studio popovers cover what they cover The auto-layout menu sat on the glass tokens, which carry 42-58% opacity when the user has transparency on. That reads as depth over the workbench, where the rails and the bar use it, and as a mess over the inspector, where this menu opens: two layers of text through each other, neither readable. The export dialog was worse — it named --panel and --card, which are not tokens here, so its background resolved to nothing at all and the whole thing was see-through. Both are opaque now. The other glass surfaces are left alone: they float over the workbench, and that is what the material is for. The print preview also fits the pane. A spread sheet is over 400 mm across, so at 1:1 the book ran off the side and had to be read by scrolling sideways. Screen only — the print stays at full size. @ * fix(journey): a cover keeps its own size, and a trim size can be typed Three things the export and the page setup got wrong. Spread mode made every sheet as wide as the widest so that one @page rule would cover them all. That put a cover — one page — in the middle of a spread-sized sheet with white either side, which is not a cover. Each sheet is now sized to what is on it, and the print CSS carries a named page rule for the single-page ones. The trim fields clamped on every keystroke, so typing 500 meant the field saw 5, clamped it to the minimum and wrote that back under the cursor: the number could not be typed at all, only nudged with the arrows. The field now keeps what is being typed and tells the document about values it can use. The arrows are unchanged, and leaving the field still clamps — someone who typed 5 and clicked away meant the smallest book. And the autosave could loop. The save effect depended on the whole store object, which is new on every render, so after a conflict — where the local document is by definition not the saved one — it was a save attempt per render: a 409, a re-render, another attempt. It depends on the callbacks now, and a conflict holds the autosave until somebody answers it. * feat(journey): page numbers pick their own colour A book has dark pages and light ones, often on the same spread, so one folio colour is wrong on half of them: the warm grey that reads on paper vanishes into a full-bleed night photograph, and white vanishes the moment the page is white. The way out used to be setting it per spread, which the document has no place for. The renderer asks what is under the number instead. It knows every element and where it sits, so it walks them from the top down and takes the first one that covers the spot: a shape's fill is arithmetic, a photograph gets white with a hairline of shadow — unknowable without decoding it, and dark more often than not once printed — and bare page takes the page colour. A heuristic, deliberately: the alternative is sampling pixels from an image that may not have loaded, in a renderer that also has to run for print. Anyone it gets wrong can still pick a colour, and picking one turns it off. * feat(journey): see who else is in the book, and where they are Two people editing the same document without seeing each other is how you get two people editing the same spread. So: a badge in the bar saying who has the book open, and an arrow with a name on it for each of them. The coordinates are millimetres on the spread, not pixels on a screen — the two of you are at different zoom levels on different monitors, and a pixel means nothing to the other one. They carry a spread index too, so a pointer on page 40 is not drawn on page 2. Ephemeral throughout. Nothing is written down, the room is the authorisation for the pointer path, and a socket that dies takes its arrow with it rather than leaving it on everyone else's page. Presence is keyed by socket because two tabs are two pointers; the badge folds them back into one person, because two tabs are not two people. The rate limit needed room. Pointers move about ten times a second, three times what the per-socket limit allows, and that limit is what stops a client flooding the process — so it is now two: an outer ceiling every frame counts against before parsing, and the original tight limit on everything a pointer is not. Malformed JSON still counts against the tight one, which is what the guard was for. Throttled to ten frames a second going out and interpolated coming in: sixty would be five times the traffic for something the eye cannot use, and drawing ten as they land reads as a stutter rather than a hand. * fix(journey): keep the zoom bar on screen at every zoom level Zoomed far enough in, the bar slid off the bottom of the window — and it is the only way back out, so the editor was stuck at 300%. The workbench sat in a grid track sized `auto`, which grows to whatever is in it; `overflow: auto` on the child does not stop that, because a grid item's minimum size is its content unless told otherwise. So at 300% the box grew to 2400px inside a 660px window and took its absolutely positioned bottom edge with it. The track is bound now, and the workbench scrolls instead of growing. The bar also has a z-index, for the same reason it has to stay in view: it must never be the thing something else covers. * feat(journey): Studio replaces the old book export The journey PDF and Studio were two ways to print the same book that disagreed about what it looks like — and only one of them can be edited. The old export goes: the two buttons on the desktop already sat next to the Studio one, and the renderer they called is deleted rather than left as a second answer. Nothing takes its place on the phone. The book is a Studio document now and Studio is a desktop editor; a phone-sized PDF of something laid out for print was the old export's answer to a question nobody was asking. * feat(journey): lay the book out the way a travel book is laid out The auto layout built every spread the same way: a picture on the left, words on the right, and nothing else. It came out looking like a template because it was one — and on a journey with little in it, like a stack of blank paper. Five layouts now, chosen by what an entry has and alternating as the book goes on. A place page for a stop nobody wrote about, with the country pale behind the name and the coordinates under it. A story page with a small map of the stop and the picture bleeding off three edges. A panorama across the fold. A gallery with the hero on one page and a ruled strip on the other. And every fourth picture spread goes full bleed with the words set over it, because a book of loud pages has no loud pages. The marks are what actually make these pages: a flag beside the country, a date numeral, a chip saying which day this is, a rule along the foot with a dot showing how far in you are. Each is trivial and together they are the difference between a page that was designed and one that was filled in. All of them are elements the panels can make, so what comes out can be taken apart. The summary spread gained a heading and the furthest point drawn as two dots and a line — that figure means nothing until it is a distance between two names. The countries page went dark, because the printed one is: pale outlines on near-black is the single most recognisable page in these books. Two things the old layout got wrong are fixed on the way. Entries with nothing on them share one page instead of taking a spread each, in the order they happened rather than gathered at the end. And an entry whose photographs have not arrived gets the frames they will go in, empty, rather than blank paper — the layout is finished and the pictures are the only thing missing, which is the right way round. * feat(journey): build the spreads out of areas, and set the elements in ink Two things, both about what a page is made of. The layouts were photographs with captions. A printed travel book is built out of areas: a page laid solid in ink with pale type on it, a band down the outer edge, a picture that overruns the panel it sits against, a box ruled around a block of text. Two more layouts do that now — one with a whole page in ink and a second photograph crossing the fold onto it, one with an edge band and the words in a ruled box, pictures at two sizes and one overlapping the hero. Six layouts on a rotation, so the book stops reading as a template. None of it needed a new feature. The document paints in array order, so a panel pushed first is a panel everything else lands on; that is all layering is, and it needed using rather than adding. And the travel elements are ink by default rather than the app's orange. A book is printed and a printed page is ink on paper; a colour that arrives without being chosen turns every element into the same accent whether the book wants one or not. Picking one is a click. The dark map is the exception — the route goes pale there, because ink on a near-black country is a line nobody can see, and only the default is overridden: a colour somebody chose stays theirs. * fix(journey): three things the editor got wrong An empty photo frame rendered on its own, ignoring frameStyle entirely — so a Polaroid placeholder was a plain dashed rectangle until a photograph landed in it and the chin appeared from nowhere. The two branches are folded together now: the surround is drawn once and only what goes inside it differs, so a frame shows what it will look like before it is filled. Adding a page to a book with no inner pages yet put it in front of the cover, where it could not be moved back from either — a move only ever swaps with another inner spread, and the cover is not one. An empty book reports its last inner spread as -1, and -1 + 1 is 0. The insert is bounded at both ends now. And snapping only knew the outer safe lines. A spread draws that dashed rule inset from each of its four vertical edges, so dragging inwards caught the fold and nothing else — the line you could see just before it was not a target. All four are, along with the centre of each page and the quarters within it: on a spread the halfway mark is the fold, so a picture centred on its own page had nothing to find. * feat(journey): take the auto layout's spreads from templates drawn by hand The layouts written as code are what a function can reason its way to: a picture here, words there, margins that add up. What they are not is designed — a panel bled off one edge, a shape running off a corner, a strip of pictures at two sizes with the coordinates set beneath them. Those decisions come from looking at a page, and the editor is where looking at a page happens. So a spread built in Studio can now be the layout. `extract-templates.cjs` reads a journey's book and writes its spreads out as data, with every measurement divided by the page it was drawn on — a template built on a 210mm square lays out on an A4 landscape book without being redrawn. `applyTemplate` does the other half: it fills what the entry can answer for and copies everything else as drawn. That division is the whole contract. Text carrying a binding takes the title or the story; empty frames take the photographs in order; the day, coordinate, date and country marks take what the stop knows. Panels, rules and decorative shapes are the design and are left exactly as they were put. A template is one *for an entry* when it uses one — which has to come out of the drawing rather than a label somebody remembers to set. A summary spread of figures and country outlines reads perfectly well on its own, and dropping a day's photographs into it would be nonsense. Two templates ship with this, drawn by the person who will use them. The built-in layouts stay as the fallback for entries no template suits. * feat(journey): turn elements freely, and pass a spread on as a file Rotation by the corner, the way it works everywhere else: a handle sits diagonally outside each of the four corners of the selection, and dragging one turns the element by the change in angle rather than to the angle under the pointer, so it can be picked up anywhere without jumping. Held to 15 degree steps unless shift is down. Four handles rather than one because a single handle off the top right sits under the inspector for anything in the right page's upper half. And a spread can now leave the book it was made in. The zoom bar downloads the one on screen as a file; Import, beside Add spread in the pages rail, brings one back. Measurements travel as fractions of the page, so a spread drawn on a 210mm square lays out correctly in an A4 landscape book, the same way the auto layout's templates do. What deliberately does not travel: - Photographs. The file carries the design, and the frames arrive empty. - The map source. A static map freezes the URL it was rendered from, and on a Mapbox instance that URL has the access token in it, so a file meant to be posted in a forum would carry a credential. Coming the other way, a tile template from a stranger is a URL every reader's browser would fetch tile by tile: an IP address handed to whoever wrote the file. An imported file is treated as what it is, somebody else's JSON. It is read in the tab that chose it and never uploaded, parsed and never evaluated, and every element goes through the document contract, which drops unknown fields and range-checks the rest. Colours in particular are #rrggbb or nothing. The size of the file and the number of elements are both capped, because the damage a hostile file can do here is not code execution, it is handing the editor more than the server will accept and leaving a document that will not save. Also fixes the rotation handle being drawn but not grabbable: the chrome layer and the selection box both pass pointers through, and a handle has to opt back in with pointer-events. * docs(wiki): add two Studio screenshots for the addon page The editor with a stats spread open, and the frames panel. Both are what the Journey addon page will want once Studio ships, and both are wanted now to show the feature off while it is still in review. * test(realtime): cover the book room's refusals and its dead sockets The realtime coverage ratchet caught what the book room work left behind: the three handlers each have an early return for a message that is missing its journey id or comes from a socket with no user, and none of them was exercised. Every one of those is a silent failure by construction. A handler that did something with a missing journey id would not throw, it would put a socket somewhere it does not belong, and nobody would notice until two strangers were looking at the same page. The other half is sockets that are in a room but cannot be used: a connection that dropped before its close handler ran, or one put in a room without ever being registered. The peer list has to walk past both rather than showing a ghost, and the broadcast has to skip them rather than throwing on a path that runs ten times a second per editor. Both files are back to full branch coverage, so the domain's pins hold as they are rather than being lowered to fit. * feat(journey): make the route map a map of the journey Four things were wrong with it, and they compounded. **It showed the wrong place.** The view was fitted to the country outlines as well as the stops, so a trip that stayed inside Berlin was drawn as the whole of Germany with two dots in the middle of it. It fits what the journey did now, and the outlines run off the edge of the frame the way a coastline does on any real map. Fitting to the country is still there as a deliberate choice, for the page every travel book has, and how much air to leave around either is a setting rather than a constant. **It drew a line nobody travelled.** Stops joined in order is a claim about the journey that is almost always false: it crosses mountains, water and borders the trip went around. TREK already stores routed geometry per place, from the planner and from imported GPX, so the map now follows the road where the trip knows it and falls back to joining the stops where it does not. Segments stay separate, so a trip with a flight in the middle does not grow a road across the sea. The geometry is thinned when it is frozen into the element: a printed line gains nothing from a point every fifteen metres, and a book carrying every GPS fix of a three-week trip is a document nobody can save. **The tiled and static sources drew nothing at all.** The tile grid was computed, the route was projected onto it, and then no picture was ever rendered — the map came out as a frame with a line across it. Three separate faults behind that: the imagery layer did not exist, `{s}` was left unsubstituted so every tile URL named a host that does not resolve, and the grid was cut from the tiles the route happened to sit on rather than from what the frame shows, so it stopped short of the edge. The frame decides the grid now, and it covers by construction. Tiles overlap by a tenth of a millimetre, which closes the hairline of white paper that rounding left between them. Mapbox needed one more thing: `mapbox/standard` is a 3D GL style and the Static Images API refuses it outright, so an instance configured for the planner's map was configured with a style this cannot use. It falls back to the classic equivalent, and a URL frozen into a document before that existed is repaired on the way out rather than left broken for good. **A map was always a rectangle.** It can be cut to the outline of the countries now, so the picture *is* the country: no frame, no box, the page showing through around the coastline. That is the version worth laying next to a photograph, and the one thing a rectangle can never be. The tile grid and the vector fit are projected from one extent so the picture and the shape it is cut to line up — two fits meant the country was full of the wrong towns. Also here: the credit line comes off the map itself. It is still resolved and still stored, for the colophon, which is where a book has always credited its sources. * feat(journey): split the country list, and trim the map cards The country list and the country grid were compositions somebody else made: they decided the order, the spacing and the type size, and the only way to change any of it was to not use them. They are gone, and what is left is the same entry — the name over its silhouette, set the same way — as an element placed one country at a time. Three down a page is the list, with the spacing yours; one at 80mm is a chapter opener, which the list could never be. The name is editable, so numbering them "1. Germany", "2. Netherlands" is typing rather than a feature. The compact mark, outline beside the name at the size of a line of type, stays for the places that want a mark rather than a heading. The map section offers the four vector styles and nothing else. Tiles, Mapbox and the cut-out are one click away in the inspector, where the rest of the map's settings already live, and four cards that are the same map four times were crowding out everything under them. A map is fitted to the country by default now, which is the picture a travel book usually wants. Fitting to the stops is still there and still matters the moment the trip is smaller than the country it happened in. Also: no navigation fallback from the dev service worker. In production it is right — offline, a deep link has to be answered by the cached shell. In development it answers a reload with the index.html it cached earlier, whose script tags point at module URLs from before the last restart, so the browser re-runs the previous version of the app while the editor shows the new one. Every explanation for that is wrong until someone thinks of the service worker. * fix(journey): drop what the trimmed map section left behind Three bindings that only fed the cards removed in the commit before: the map sources hook, the country codes the cut-out card needed, and the frame the preview sized itself from. Lint had them as warnings rather than errors, so they would have ridden along quietly.	2026-08-19 23:36:42 +02:00
Maurice	503a03792e	test(photos): cover the local EXIF path so the memories ratchet holds ... The capture backfill landed in src/nest/memories/ with its local branch untested, which took the domain under its coverage floor (functions 96.71 vs 97, branches 79.67 vs 81). Raising the tests rather than lowering the gate: the path guard against climbing out of the uploads tree, a missing path, an unreadable file, the CreateDate fallback, empty EXIF, a throwing row lookup, and schedule(). Plus the Immich album mapping with and without coordinates. One note left in the test file for the next person: a mock that *rejects* makes vitest fail the run even when the code catches it, because the mock's recorded result is a second reference to that promise with nothing attached. A bare mockReset() is enough to trip it, so the beforeEach sets a benign default.	2026-08-18 22:24:29 +02:00
Maurice	56b4509b03	feat(journey): put photos on the map where they were taken ... The visible half of the capture-metadata work (#1614). Photos that know their coordinates are drawn as thumbnails on the Journey map, in the shape the report asked for: a picture rather than an abstract pin, and a count when several collapse into one. Clustering is a screen-space grid rather than a library. The Journey maps have never had clustering, and the one the planner uses hangs off react-leaflet while this map drives Leaflet directly; bucketing by rounded pixel position is a few lines, is deterministic, and does the job — photos of one place collapse into one thumbnail with a count, and pulling the map apart separates them again. The layer sits below the entry pins, because the itinerary is the point of the map and the photos are context. Its own effect, so photos arriving do not tear down and rebuild the map the way the entry effect does, and redrawn on zoom and pan because the buckets are in screen space. The thumbnail URL is built in the page rather than the hook: it needs the share token, which is the credential the byte proxy checks. Also re-points the trailing-migration guard at the new last slot, which is what its own comment asks of anyone appending one.	2026-08-18 22:24:29 +02:00
Maurice	1a0834b866	fix(maps): resolve the Places key per instance, not per whoever is asking ... Searching worked for the admin and 403'd for every other member. getMapsKey read the calling user's own row first and then fell through to "any admin" via LIMIT 1 with no ORDER BY, so the admin who pasted the key hit their own row while everyone else got a non-deterministic stranger's. That fallback is what CLAUDE.md forbids. The Places and Unsplash keys bill the install, not the account that pasted them in, so they become instance configuration: an encrypted app_settings row, resolved as env -> instance -> the caller's own row, the same shape #1772 chose for the LLM endpoint. The per-user column stays as the last step because /me/api-keys has always accepted a personal key. The trailing migration carries an existing install's key into the instance row so nothing degrades to OpenStreetMap on upgrade, but only where that key already was the whole install's: as soon as a second row holds one, it is left alone, because the instance row outranks everybody's own column and an upgrade must not move a member onto someone else's key and bill. Two things from the same report: The key test button probed with field mask places.displayName while the search asks for places.rating and more, which is a separate SKU and can be restricted on its own, so the button could pass while every search failed. It now probes the resolved key with the search's own mask. Saving API keys wrote no audit line. It now writes one settings.api_keys_update row naming which fields changed, never their values, comparing cleartext because the random IV makes every ciphertext look different. Closes #1939	2026-08-17 14:48:23 +02:00
Maurice	ff27624e02	fix(reservations): scope the per-day position write to the trip ... updatePositions has two branches. The legacy one updates `WHERE id = ? AND trip_id = ?`; the per-day one, three lines below it, bound the caller's ids straight into reservation_day_positions and never touched the tripId it was handed. That table has no trip_id of its own and its two foreign keys only require the ids to exist, so nothing further down caught a pair that did not belong together. The trip now comes from the join, so the row materialises only when the reservation and the day agree on it. Doing that in the statement rather than as a pre-check also turns a stale id into a quiet no-op instead of a foreign-key error surfacing as a 500, and lets an omitted day_plan_position bind the way the wire contract has always said it may. reorder_reservations reports a day that is not on the trip, the way its sibling tools in that file already do, and a migration clears rows whose reservation and day disagree.	2026-08-16 21:57:21 +02:00
jubnl	61e03fdfde	feat(oidc): honor remember-me in SSO login (#1927)	2026-08-15 22:48:03 +02:00
Maurice	f02a4b5654	feat(maps): bill a place search as one session instead of per keystroke ... Google charges autocomplete per request unless the requests carry a session token. With one, the keystrokes of a single search and the details lookup that ends it are charged together, which is also how a user experiences it: they looked up one place. TREK sent no token at all, so every debounced keystroke was its own billable request. On a busy trip that is the largest line on the Places bill, and it is paid by whoever owns the key, which for a self-hosted instance is the person running it. A session opens with the first suggestion request and closes when the user picks a result. It has to close on the abandoned paths too: a token carried into the next search would merge two searches into one billed session and scope the suggestions wrongly. So the search box clearing it, the text-search fallback and the error paths all end it. The token is validated on the way in. The autocomplete body goes through the Zod pipe, the details query does not, so the controller shape-checks it there. Anything that does not match Google's URL-safe 36-character form is dropped rather than forwarded, which falls back to per-request billing instead of breaking a lookup. A cached details hit never reaches Google and so never closes its session. That is billing-neutral: an unclosed session is charged as a plain autocomplete session, which is still cheaper than the per-request behaviour it replaces.	2026-08-14 23:42:51 +02:00
Maurice	f23de88b74	fix(packing): authorize every single-item path against the item, not just the trip ... A packing item is Common, Personal or Shared with named recipients. listItems() always applied that rule, but every path that touches one item resolved it by trip id alone, so trip membership plus packing_edit was enough to reach an item the member could not see. Update, delete, clone, the contributor routes and the sharing route all shared the lookup, and the same service methods sit behind the MCP tools and the plugin RPC, so all three transports carried the gap. The update was a read as well: it answered with the enriched row, which hands back the name, category, quantity, weight, the owner's username and the recipient list of an item the caller was never shown. Two flows laundered restricted items into places they do not belong. Saving a trip as a template read every row in the trip, so a template captured the names and categories of everyone's Personal items. Copying a trip did the same and re-inserted without is_private/owner_id, so both fell back to the column defaults and another member's Personal or Shared item reappeared in the copy as a Common item. That path needs only trip_create and trip access, not even packing_edit. There is now one visibility rule in the service and every single-item lookup goes through it. The actor is threaded through the HTTP, MCP and plugin-RPC entry points, and a missing actor denies rather than falling through unfiltered. An item the actor may not see is reported as missing, not as forbidden, so the routes cannot be used to confirm that an id exists. Two deliberate contract changes fall out of that. The sharing route answers 404 instead of 403 when the caller cannot see the item at all; a visible item they do not own still answers 403. And a template or a trip copy now carries the Common list plus the actor's own items, with a restricted item staying restricted and owned by the copier. Reported privately by Chichi (@vickyzer027-hash).	2026-08-14 22:09:21 +02:00
Maurice	9dd0a851ca	fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923) ... * fix(mcp): accept per-leg times on create_transport and update_transport metadata was pinned to Record<string, string>, so a legs array could not get through and a multi-leg flight built over MCP lost every intermediate time. The booking ended up with correct endpoints and no legs, which every reader then treats as a single segment. legs is now a real, typed parameter with its contract in @trek/shared, shaped exactly the way the planner form and the importers write metadata.legs. The folding checks what the readers depend on: one leg fewer than endpoints (the AirTrail dedupe builds its signatures on that), day ids that belong to the trip, airport codes that agree with their endpoint, and the times, where a stopover endpoint carries the departure and the last one the arrival. metadata keeps its type and its replace semantics. Segments smuggled through metadata.legs as a JSON string used to be stored and then ignored by everything that read them; they are refused now and point at the legs parameter instead. Closes #1914 * fix(atlas): refuse a bucket list entry that is already on the list Nothing gave a bucket entry an identity, so the same country could be added as often as it was clicked. A wish is now identified by name, country, target date and, where it has them, coordinates. A different target date is a different wish and still lands, which is what the report asked for; two real places sharing a name stay separate because their coordinates differ. Empty string and NULL are normalised on both sides of the comparison, otherwise the dateless case, which is the one that was reported, would slip through. Deliberately no unique index and no migration. better-sqlite3 is synchronous and the server is a single process, so the race an index would guard against cannot happen here, and an index would have needed a destructive dedupe of existing rows first. create_bucket_list_item had no target_date parameter at all, so over MCP the allowed "same place, other date" case was unreachable. It takes one now. The plugin RPC reports the duplicate as bad params instead of letting it surface as an internal error. Closes #1898 * fix(settings): keep a free-form LLM endpoint in admin hands Any account could name the address the server calls, and the guard in front of it deliberately allows loopback and LAN so a self-hosted Ollama works. That is a reasonable trade for whoever runs the instance, because the network is theirs. It is not one for an arbitrary account, which could aim a request from inside that network at a target only it chose and read how the target answered. A free base URL, and the local provider that is one by another name, now come only from an admin controlled source: the addon config, the instance-wide defaults, or an admin's own settings. OpenAI and Anthropic stay available to everyone, because they go to a fixed address with the user's own key. The resolver is where this is enforced, since it is the single point both the booking import and the plugin host pass through, and the only one that also covers values already sitting in the database. The write path refuses as well, so nothing is stored that would never be read. The hint text promised something users no longer have, so it changed with it. Closes #1772 * fix(calendar): span a date-only booking to its end date A DATE event without DTEND is exactly one day per RFC 5545, so a multi-day booking that carries an end date still collapsed onto its first day. It gets an exclusive DTEND now, built the same way the stay branch already builds one. A booking without an end date serialises byte for byte as before. While in here: the stays query joins reservations on the accommodation, and two bookings pointed at the same stay fanned it out into two events sharing one UID. Duplicate UIDs in a feed are undefined behaviour and calendar clients pick one at random. The same "at most one booking per stay" assumption sat in the accommodations service, where it was worse than cosmetic: accommodation_id carries no foreign key, so deleting a stay took only the first booking and left the second pointing at something that no longer existed. Both the sync and the delete walk all of them now. The callers keep reading linkedReservationId; the list is additional. Refs #1869 * fix(vacay): say that the region is required, because it is The placeholder called the region optional while the add button stayed disabled until one was picked. The wording predates multiple calendars per plan, which is what introduced the gate. Only the value of the existing key changed, in all locales, so the key set stays identical. Two things the same screen got wrong were in the way of a clean answer: The button was clickable while the region list was still loading, which put the user in exactly the state the wording describes, and it is the state the report was filed from. It waits for the list now. Changing the country on an existing calendar kept the previous country's regions on screen, so a German region could be picked for the Netherlands. The list is cleared with the country, which only works in combination with the loading gate: without it, the empty list would happen to enable the button instead. Closes #1813 * fix(collections): let a saved place's address be corrected The edit form offered name, category and labels, and the address only on the way in. The cause was not the form: the update contract never declared address, so the validation pipe stripped it and the UPDATE had no column for it. Coordinates were pulled through for #1435 and the address was missed. It travels the whole chain now, contract to service to both forms. No migration, the column has always been there. The mobile add sheet had no address input at all, showing whatever the search result carried as read-only, so editing would have worked while creating still would not. It has one. The MCP tool description had drifted further than the address, never having mentioned the coordinates either. Both are in it now. Closes #1870 * fix(collections): keep the place search usable after the first save The add dialog stays open on purpose so several places can be added in a row, but after a save it gave no way back into the search. A search with no results was silent, with no empty state and no toast, so typing another name and pressing enter looked like nothing happened. The reporter described both halves and it is the silent search that matches "nothing happens" most closely. There is an empty state now, using a key that already existed in every locale and was unused. The search row is sticky inside the dialog body, so it stays reachable after the save instead of sitting above the scroll position. Also fixed while in here: refreshing the collection after each add reset the select mode, the selection and the label filter. In the very flow this dialog is built for, the user quietly lost all three. Closes #1921 * fix(vacay): make the phone year grid and the dock button do what they look like Two separate faults met on this screen. Tapping a day in the year grid did nothing unless the edit mode was already on, and the only way into it was a floating button that looks exactly like the one the dock draws in the same spot. A tap now opens that month in the editor, where the cells are big enough to hit. At 390px the grid cells are around 21px, which is too small to be mutating data with in the first place. The dock's plus was not wired for this route, so it fell through to creating a trip on the dashboard. Two different actions were stacked in one place, and the wrong one was on top whenever the screen had not painted yet, which includes the time its chunk is still loading. The dock leaves the slot to the screen now, and holds the geometry so the tab groups stay symmetric. Closes #1811 * fix(budget): settle in whole cents so balances stop drifting The report is a balance that moves on its own, with nothing added, edited or removed, on a trip where everything is in euro. Two mechanisms were behind it and both are real. The display currency is a fourth value, a per-user setting, so "everything is in euro" never covered it. Each balance was converted and rounded on its own, and the set no longer summed to zero: at 0.855 and 0.9312 it came out one cent over, at 0.94 it came out even. That cent appears and disappears with the six hour rate cache alone, which is exactly the symptom. The flows were rounded separately from the balances, so the two never had to agree. And a receipt line nobody was ticked for counted toward the total, and therefore toward the payer's credit, while landing in no share. That difference is permanent, and the client sent it that way. The settlement converts once, at the edge, and does integer arithmetic after that. Equal splits distribute the credited cents by largest remainder rather than the entered total, so credits and debits of one expense cancel exactly even in a foreign currency. Display conversion goes through the same largest-remainder allocation, so the sum survives it. With that, the 0.01 epsilon can go. It could never create a cent, but it stranded them: a one cent balance was filtered out of the flows while staying visible in the list, which is the "settle up offers nothing" half of the report. Closes #1382 * fix(journey): reach the book export and the suggestion toggle on a phone Below 1024px the hero card is dropped, and it held the only way to either action. The floating bar that replaces it was never given them. It has them now, and the hero is unmounted rather than hidden, so there is no second invisible copy of the same controls in the document. The bar's own buttons moved onto the appearance tokens while they were being touched. The phone screen never had either action at all and now carries both. The book itself was hardwired to English, cover and dates included, while the keys for it had been sitting in every locale unused. It takes the page's translator and locale, sets the document language, and prints mood and weather, which were on screen but never in the book. Closes #1848 * fix(journey): offer the connected photo providers in the phone entry editor The desktop editor grew an external photo source in #1632; the phone editor that came out of the mobile rewrite never did, so editing an entry on a phone had no way to Immich or Synology. It mirrors the desktop mechanics, including the part that is easy to miss: a save that creates the entry and then fails on the photos keeps the sheet open, and without remembering what was just created the retry creates a second entry. The sheet no longer kicks off its own addon load. The list is loaded once on boot and this only reacts to it; a second load races the other consumers and overwrites the store when it lands. Closes #1808 * fix(mobile): let the document scroll so Safari can collapse its URL bar iOS Safari only shrinks its address bar when the document scrolls, and TREK's never did: the root was locked and the mobile shell put a scroll container inside it. On the bottom tab layout that costs about a sixth of the viewport, permanently. Below 768px the document is the scroller again and the full-bleed screens measure their own height instead of leaning on the shell. That makes the body scroll locks real for the first time on a phone, and they were not ready for it. Three of them reset the overflow unconditionally, one of those on every run of its effect rather than on unmount, so a system notice could hand the page back while a sheet was still open. They all go through one reference counted lock now, which is the part that had to land first. Worth knowing for the issue: this reaches the flow screens. The trip planner, the journal, the atlas and the vacay screen keep their own full-height scrollers and still will not collapse the bar. Closes #1809 * fix(mobile): keep the screen gradient visible behind the translucent cards The gradient layer introduced with the scroll change sat at z-index -10. A negative layer paints above the canvas but below the backgrounds of ordinary blocks, and body carries an opaque one, so the gradient was hidden behind it. The mobile cards are translucent and take their depth from what is behind them, so every surface ended up compositing against a single flat colour and the whole phone UI read as one tone. The layer is positioned at z-index 0 now and the content above it at 10, which puts both over body's background. Same visual as before the scroll change, and the shell still owns no scroll container. * test(reservations): teach the accommodation delete stub about the id lists The RPC walks every linked booking since the delete stopped stopping at the first one. The stub still answered with the two singular fields, so the loop had nothing to iterate and the cascade events never fired. * fix(settings): move the free-form LLM endpoint out of user settings entirely Hiding it from non-admins closed the hole, but it left the option sitting in the admin's own personal settings, which is not what was asked for and not where it belongs: an instance has exactly one address it calls out to, and there was a second, invisible place to set it. The provider list is now the two hosted ones for everybody, the endpoint field is gone, and the resolver takes the address from the admin-controlled instance defaults for every caller including an admin. It no longer reads the users table at all. The write path refuses the keys for everyone, so nothing can be stored that would never be read. The endpoint is configured on the addon in the admin settings, which already carries provider, model, base URL and key, plus the Ollama model list. Nothing is lost, it just has one home now. Behaviour change worth a release note: an admin who set a personal Ollama endpoint has to move it to the addon config. A non-admin was already in that position after the previous commit. Refs #1772 * fix(journey): make the book preview usable on a phone The preview document carried no viewport, so a phone laid it out at its default 980px while the page is A4 landscape and about 1123px wide. It spilled out of the frame, which reads as being zoomed far in. Declaring the real width lets the browser scale the page to fit. Printing is unaffected, it goes by @page. The preview chrome had the same problem in miniature: a title and two labels on one row, sized inline, which does not fit a phone and fits translated labels even less. It moved to a stylesheet, and below 640px the card goes full-bleed, the decorative title steps aside and the two actions share the width. Refs #1848 * fix(mobile): stop the shell trapping the screens' own overlays Lifting the background layer into the positioned range meant the content wrapper had to be positioned too, and a positioned wrapper with a z-index is a stacking context. Every fixed overlay a screen renders inside it got clamped to that level: the vacay view/edit FAB sits at z-50 precisely so it beats the dock at z-40, and it disappeared behind it. The layer goes back to a negative z-index and the wrapper back to no positioning at all. What it needed in the first place was for body to stop painting over it, which is one line in the phone media block rather than a new stacking context. * fix(mobile): let the phone background override actually win A media query adds no specificity, so the themed body rule further down the file kept winning on source order and painted over the shell's background layer. The override is on html body now. The gradient was back to being invisible, which is the flat single-tone phone UI again. * fix(vacay): draw today's ring around the day instead of replacing it On the phone, today short-circuited the day-cell matrix and returned a ring on an empty cell. A vacation day or a company holiday logged for today was stored and counted in the totals, but the cell showed nothing, so it read as if the tap had not taken. Today is an annotation now, layered like the school band and the shared-calendar rings, which is how the desktop month card has always treated it. The strong ink stays only where the cell has no fill of its own, since --m-ink is light in dark mode and would disappear on a pastel. * fix(map): stop serving a stale GL style document from the service worker The Workbox rule for Mapbox matched every URL under api.mapbox.com, and the style document lives there too. Under StaleWhileRevalidate the map was built from the previous revision on every load, with the refresh landing one load too late, so a style republished in Studio with different label languages kept rendering the old ones. The network tab showed a 200 throughout, because the service worker's own answer is a real 200, which is why this looked like the app rewriting text-field at runtime. The style now has its own rule ahead of the tile rules, on NetworkFirst so it is current whenever the network is, and still cached so the map opens offline. Its own small cache too: sharing an LRU with three thousand tiles made the staleness come and go at random. OpenFreeMap styles had the same problem and are covered by the same rule. Closes #1924	2026-08-13 14:06:35 +02:00
Maurice	3c5e406229	feat(places): link an expense to a place, the way bookings already do (#1917) ... * feat(places): link an expense to a place, the way bookings already do Recording what a museum ticket or a guided tour cost meant leaving the place, opening the Costs tab and typing it in again — while a booking has had a Costs block in its own form all along. The place form now carries that block. Same component, same flow: with nothing linked it offers Create expense, which saves the place and then opens the Costs editor for a new expense pointing at it; once linked it shows the expense with edit and remove. budget_items gains place_id beside the reservation_id it already had, with the same nullable FK and the same ON DELETE SET NULL. Desktop and phone both, and the mobile editor carries the link through its own save path rather than the desktop one. The expense belongs to the place, not to a day assignment, so a place sitting on five days is not five tickets. Hanging it off the assignment would have meant adding a place to three days quietly creating three expenses and removing a day quietly deleting one. Deleting a place takes its expense with it in the same transaction and announces it, on every path that deletes a place: REST, both MCP tools and the plugin RPC. Closes #1298 * test(places): teach the RPC stubs about linkedExpenseIds The delete paths read the linked expense before the place is gone, so the two hand-built PlacesService stubs threw on the new method instead of reaching the hook, the remove and the broadcast — four failures out of one missing line.	2026-08-12 21:37:12 +02:00
Maurice	df3edac7b9	feat: six community requests — import dedup, accommodations in the feed, OAuth refresh race, visited-from-trip, journal jumps, phone packing rows (#1915) ... * fix(places): match imports on the provider id so renamed places are not duplicated Re-importing a Google Maps list duplicated every place the user had renamed. buildDedupSet only ever collected names and, for unnamed places, coordinates, and isPlaceDuplicate returns on the name before it reaches the coordinate fallback, so a renamed place was findable by neither. The ids were stored all along, and even backfilled onto matched places, they were simply never read. Match on google_place_id / google_ftid / osm_id first, keeping name and coordinates in their old roles below it. Widening the coordinate check instead would have merged the restaurant and the bar in the same building. The collection copy carried a hand-mirrored port of the same predicate; it now uses the shared helpers and gets the fix with them. Closes #1550 * feat(calendar): put accommodations into the subscribed feed as all-day stays A hotel keeps its dates on the linked stay, not on the reservation: the booking form writes reservation_time = NULL for type 'hotel', and day_accommodations carries start day, end day and the check-in/out clock. The feed only ever read the reservation, so a stay showed up once on the arrival day at best, and not at all when it came from the booking form. Join the stay in and emit the reservation as an all-day range over every night, which also keeps it correct when days are reordered later — the dates now come from the day rows rather than from the copy stamped at creation time. Check-in and check-out become their own timed events when the stay records a clock, because an all-day event cannot carry the time you actually need reminding of. The check-in window, when set, becomes that event's DTEND. Closes #1586 * fix(oauth): treat a concurrent refresh as a race, not as a stolen token Refresh rotation is a race by construction. Several MCP clients share one refresh token, both post it within the same second, and the loser was read as a replay: chain revoked, MCP sessions torn down, browser window asking to log in again. That is the daily re-authentication people were seeing, not a short lifetime — access tokens last an hour and refresh tokens roll for thirty days. A revoked refresh token now only counts as a replay once it is outside a 30-second grace window, and only when the rotation that revoked it left a successor still alive. Inside the window the caller gets its own pair branched off the same parent, so both clients walk away with a working token. Explicit revocation leaves no live successor and a chain killed by a real replay has none either, so neither can slip through the window. Closes #1007 * feat(collections): mark a place visited from the trip it belongs to A place saved in several lists had to be opened in each of them to say you had been there, which is the wrong way round: you find out you have been somewhere while looking at the trip, not while browsing the library. The save picker now shows each list's own status and cycles it in place, with one action for "visited, wherever this is saved". The planner's selection bar and the mobile bulk toolbar carry the same thing for a whole selection — select all, one tap, done. Matching happens on the server with the signals findMembership already uses plus the source link a place saved from this trip carries, so a copy renamed inside a list is still found. Lists you may only read are skipped rather than refused; a shared list you cannot edit should not stop you marking your own. Closes #1469 * feat(journey): jump to the top or back to the last entry in a long journal Everything that adds to a journal sits at the top — the entry button, the gallery upload — and where you left off sits at the bottom, so adding one photo to a long journey meant scrolling the whole way twice. Two buttons float over the middle of the feed, clear of the Add Entry column on one side and the reorder arrows on the other, each appearing only when there is more than a screenful to travel in that direction. They live in a zero-height sticky box so they take no layout space and never push the timeline around. While in the header, the status pill also picks up the height of the round buttons beside it. Closes #1088 * fix(packing): give the item name the row back on phones An item name had roughly a third of the row to itself: a spelled-out sharing sentence, an empty weight column and two round action buttons took the rest, so anything longer than a word was cut off. Sharing is now the icon it always was next to a label rather than a sentence in the layout, an unset weight prints nothing instead of a dash, and edit/delete sit behind one overflow button that opens the same inline menu the bag picker already uses. The to-do list needed none of this — it wraps its chips onto a second line already. Closes #1525 * docs(wiki): cover the six community changes - Calendar feeds: accommodations as an all-day range plus check-in/check-out - Collections: setting the visited status from a trip, and how places are matched - Journey: the jump buttons on a long journal - Packing: what the phone row keeps and what moved behind the overflow button - Places: re-importing a list no longer duplicates renamed places - MCP setup: the rotation race no longer ends an OAuth session * test(collections): assert the stored status instead of a private method tests/ sits outside the build tsconfig, so reaching into getPlaceById only showed up in the dedicated typecheck step. Reading the row is the better assertion anyway — it pins what was persisted, not what a getter returns.	2026-08-12 17:43:22 +02:00
Maurice	27ffd3ec68	fix(db): append the incoming leg mode migration so upgrades pick it up	2026-08-12 09:08:47 +02:00
Ida Rogalska	f5e06e0dea	test: outgoing and incoming leg modes persist independently	2026-08-12 09:08:47 +02:00
Ida Rogalska	cedbe39b35	api: PUT /assignments/:id/transport gains direction (outgoing|incoming)	2026-08-12 09:08:47 +02:00
Ida Rogalska	edb21b681f	read: project incoming_leg_transport_mode via rowShape + getAssignmentWithPlace	2026-08-12 09:08:47 +02:00
Ida Rogalska	a17bfdb1a1	db: add incoming_leg_transport_mode to day_assignments	2026-08-12 09:08:47 +02:00
jubnl	7e7277beb0	fix(vacay): enforce weekend blocking in toggleEntry service ... With block_weekends on, toggling a weekend day via MCP or the plugin RPC still added the entry and burned allowance — the guard lived only in the web UI (mcp-smoke-test I-02). toggleEntry now rejects inserts and in-place conversions on blocked days with { error: 'weekend_blocked' } (the votePoll pattern); removing an existing entry stays allowed so stray weekend entries remain cleanable. The controller maps the code to a 400, the MCP tool to an isError result.	2026-08-12 00:38:41 +02:00
jubnl	a01476f445	feat(mcp): audit MCP tool calls at the registry seam	2026-08-11 23:19:39 +02:00
jubnl	954a3ca0a7	refactor(server): serve /mcp from a Nest controller; delete auth, audit, addons and oauth bridges	2026-08-11 23:01:19 +02:00
jubnl	fac442086f	refactor(server): providerize the OAuth SDK adapter behind the container	2026-08-11 22:44:20 +02:00
jubnl	1390bfbe06	refactor(server): move health, discovery and consent-COOP behind the container	2026-08-11 22:23:51 +02:00
jubnl	2b2c6462ec	refactor(server): fold the in-container bridge edges	2026-08-11 16:32:02 +02:00
jubnl	0718bd1b0c	refactor(server): shrink the seam bridges to their live exports	2026-08-11 16:23:46 +02:00
Maurice	8c8cc2a727	Require share_manage for the two public credentials (#1883) ... Both advisories are the same mistake: a route that hands out a bearer token treated trip membership as authorisation. Membership lets someone read the trip while they are signed in. It does not let them mint a URL that reads it without an account, keeps working after they are removed, and can be rotated out from under the owner's calendar subscriptions. The calendar feed token now sits behind TripAccessGuard plus @RequirePermission('share_manage'), the same shape the rest of the trip-scoped controllers use, which also replaces a hand-written access check that GET never called at all. GET is gated with the writes because it returns the credential itself, not its status. The share link's GET does what its own POST and DELETE already did, and what the invite link next door already does for exactly this reason. Two things had to come with it or the gate would have been decoration. The MCP tool get_share_link read the same token on membership alone, so it would simply have become the new way in. And feed_token rides along in every trip payload because TRIP_SELECT reads t.*: any member could have read the value out of GET /api/trips/:id, the summary tool or the plugin RPC. It is blanked once in the select and stripped in the two places that select the row directly. The three service writes take the acting user and scope their UPDATE to a trip that user can reach. The guard decides who may manage the credential; this only makes sure a caller arriving another way cannot write to an id it guessed. Client side, "Subscribe to calendar" is now behind the same permission on desktop and mobile. Without that a member would have kept an entry whose enable button silently does nothing, because IcsSubscribeModal swallows every non-200. The one-off ICS download stays where it is: that is a file they may already read. Instances that want members to manage these links can lower share_manage to trip_member in the admin panel, which the tests cover.	2026-08-11 11:15:32 +02:00
Maurice	8e4261ed81	Delete four bridges with no consumer, and gate what runs outside the container ... Both were left open by the audit and are closed here. days, packing, photos and reservations each built a service outside the container at module load for nobody: only their own delegation tests imported them, and three domain docblocks were still telling readers to go through them. photos.bridge's own comment pointed at src/services/, a directory deleted two PRs ago. The cases that exercised them kept their assertions and call the service the bridge delegated to, so nothing that was proved stopped being proved. Twelve bridges remain, each with a live out-of-container caller. Coverage measured src/** but gated only src/nest/**, so the boot path, the scheduler, the MCP handler and the migrations sat under no floor at all. That is the same 9,602 lines where this audit found its worst defect, and a swallowed EADDRINUSE is exactly the kind of thing an untested boot path hides. Seven globs now pin what is measured today. They are floors to raise, not targets that have been met: src/*.ts is at 39% statements and src/db at 38% branches, and writing those numbers down is the point. src/demo/** is deliberately left out. It measures 0%, and a floor of zero asserts nothing; it needs tests before it needs a threshold.	2026-08-11 09:58:37 +02:00
jubnl	b82651bf93	Merge remote-tracking branch 'origin/dev' into dev	2026-08-10 22:38:05 +02:00
jubnl	1cc46f11b5	refactor(server): move the reminder crons onto the injected notifications	2026-08-10 21:49:27 +02:00
Maurice	d981719941	Serve /ws from a Nest gateway with its own adapter ... The transport was a hand-rolled setupWebSocket(server) that index.ts kicked off with a dynamic import after listen(). It is a @WebSocketGateway now, with DatabaseService and EphemeralTokenService injected instead of imported, and the heartbeat owned by a lifecycle hook rather than an interval nobody stops. The wire protocol does not move. Nest's WsAdapter dispatches on { event, data } and every deployed client sends { type, tripId }, so TrekWsAdapter translates rather than asking clients to change. It also builds the ws server itself instead of delegating: the base's port-0 branch uses noServer and performs the upgrade from its own registry, which never consults verifyClient, so delegating would have dropped the origin check and answered 101 to anyone. The per-socket error listener stays attached first, because an unhandled one kills the process (#1576), and the flood guard counts every inbound frame before parsing, because malformed frames are exactly the ones worth limiting. Four things had to stay where they were, and each is a silent failure if it does not: The socket registry stays module state. Seventeen bridges and notifications.instance build `new RealtimeService()` outside the container; rooms on a provider instance would leave their broadcasts going to an empty map, with no error and no log. The socket id stays a monotonic integer. The client echoes it as X-Socket-Id and broadcast excludes the originator with Number(excludeSid). A uuid is NaN, NaN === NaN is false, and every client would receive its own writes back, which shows up as drag-and-drop that jumps rather than as an error. buildApp creates the http server and binds the adapter before app.init(), and callers take it from getHttpServer(). Nest binds gateways during init, so a later adapter binds nothing; an adapter given the app binds to Nest's own internal server, which this process never listens on. Both boot green with no client able to connect. RealtimeGatewayModule is imported by AppModule alone. RealtimeModule is @Global, so a gateway there follows into every hand-assembled TestingModule, and Nest's SocketModule then loads an adapter none of them set: it reaches for @nestjs/platform-socket.io and calls process.exit(1). Eighteen e2e harnesses died that way before the split. src/websocket.ts survives as a re-export of the three fan-out primitives. 115 test files vi.mock that path to assert on broadcasts. The two transport suites pass unchanged, and 30 new cases pin the pieces directly: the pv and MFA gates, the numeric socket id, the plugin announcement firing before the room check, both sides of the origin allowlist, and the flood guard counting frames no handler wants.	2026-08-10 21:46:47 +02:00
jubnl	c63d6430af	refactor(server): move the auto-backup cron into the backup domain	2026-08-10 21:33:48 +02:00
jubnl	399bbda0fa	feat(server): add the schedule wiring	2026-08-10 21:22:13 +02:00
Maurice	ba7d55f999	Finish the contract ratchet, the upload bridge and the client leftovers ... BODY_CONTRACT_ALLOW_LIST is empty. The last seventeen handlers type their body with a createZodDto class, so the fail-closed boot gate has nothing left to forgive; it still refuses a boot for a new handler that reads @Body() without one. Several of those contracts describe rather than constrain, and that is the whole care in this change. The pipe runs before the handler, so a schema stricter than the handler moves a user-visible answer: - TagsController.create answers { error: 'Tag name is required' }, pinned byte-for-byte in two tests, and the pipe formats as `field: message`. The DTO leaves name optional and the handler keeps the check that owns the message. Same shape for the booking-import confirm body, which additionally gains per-item validation the handler never did. - PluginsController.activate and install answer 503 when plugins are disabled, and check that BEFORE looking at the body. A schema that rejected first would turn that into a 400 for an operator whose server has plugins off. - setEgressHosts reads a non-array `hosts` as "clear the list", which is the documented reset. Typing it as string[] would have removed a working admin action rather than tightened anything. - PluginRoutesController.route answers { route: null } at 200 for everything it dislikes, so the client falls back to straight lines. A 400 there would turn a graceful degradation into a visible error. files.bridge is gone. The multer options are built by MulterModule.registerAsync from an AllowedFileTypesService leaf, so the fileFilter reads the operator's extension list from the container instead of from a second FilesService built outside it. Nest injects MULTER_MODULE_OPTIONS with @Optional(), so a token that fails to resolve is not a boot error: it silently falls back to defaults, with no filter and no size cap. FILE-020 already proved that for trip files by uploading an .svg over HTTP and expecting 400; journey uploads had no such case, and now do. VIDEO_UPLOAD is untouched, including the filename callback that forces .jpg regardless of what the client sends, which guards the public share proxy. PluginFrame gets an onError. A frame whose document fails to load left a blank element at full height, which reads as a hung app rather than as a plugin that is gone. typecheck:tests runs in CI now, with the test tree at zero errors. tz-lookup is left as it is: the build puts it in a lazy helpers chunk, not the entry chunk, and the remaining split would trade a synchronous render for an async one to move 172 kB that is already off the critical path.	2026-08-10 19:54:46 +02:00
Maurice	ff286edc45	Widen the test stubs the typecheck rejected ... conditions.test.ts lost noTrips when the condition kind landed; oauth.test.ts lost the RFC 8707 resource indicator when it became required. Both are fixtures that stopped matching a contract that grew, and both are filled in with the value that keeps every existing case reading as it did. budget.service.calc.test.ts typed its prepare mock from the default implementation rather than from prepare's own signature, so all ten later mockImplementation calls had to reproduce that exact three-member literal. One stmt() helper names the widening instead.	2026-08-10 19:54:46 +02:00
Maurice	e5c99903ea	Pin the request body ceiling instead of inheriting it ... The Express shell set a 100kb limit and stopped applying it the moment the Nest instance took over parsing: bootstrap passed bodyParser:false and nothing replaced it. The number happened to stay the same, because it is also the framework default - but it lived nowhere anybody would look for it, and one NestFactory default away from silently becoming something else. It goes through Nest's own parser rather than a second express.json(), because that parser carries the verify hook that keeps req.rawBody, and the plugin webhook routes need the exact payload bytes to check a provider's HMAC. Adding a parser in front of it would have taken rawBody away without failing anything. MISC-009 and MISC-010 pin it from both sides. The bodyParser flag on applyGlobalMiddleware goes with it: one caller, which passed false. Not moved: cookieParser stays on the raw Express layer rather than becoming a configure(consumer) middleware. The platform routes - the OAuth consent flow among them - are registered on that instance before Nest routing exists, so a Nest-slot cookie parser would simply not run for them. helmet, CORS, compression, the forced-HTTPS 301 and the res.on('finish') logging stay for the same reason: they have to see requests Nest never routes.	2026-08-10 13:38:26 +02:00
Maurice	0d8870cff7	Stop two test suites from depending on the network and the scheduler ... The second flake recorded as 'costs' is not a timing flake. It is a live HTTPS call: budget.service.ts settlement() reaches getRates() unconditionally, unlike the two guarded call sites above it, and ExchangeRatesService fetches api.frankfurter.dev with a 10 s abort. tests/integration/budget.test.ts stubbed fetch nowhere at all, so the suite talked to the internet - fast when the API answers, ten seconds per call when it does not. The stub fails closed, which changes no assertion: every settlement case here is single-currency, so rates never enter the arithmetic. tools-budget-advanced had the stub inside a single case; hoisted so a second settlement case cannot quietly reintroduce the call. The five ReDoS budgets in maps.service.test.ts measured wall-clock time, which on a loaded machine reports how long the test waited for a core. MAPS-024 has gone red at 523 ms against an unchanged file for exactly that reason. They now measure CPU time, which is what catastrophic backtracking actually burns. This does not soften them: CPU time is always <= wall-clock time, so every budget got stricter, and pool:'forks' keeps the measurement to this file.	2026-08-10 13:38:26 +02:00
Maurice	94221a6d91	Roll TripAccessGuard onto the remaining trip-scoped controllers ... assignments, budget, collab, accommodations, reservations and booking-import drop their copied requireTrip/requireEdit helpers for the guard. Status codes and bodies are unchanged. places is deliberately NOT converted, and that is the finding of this PR rather than an omission. Its e2e suite documents that the body pipe answers 400 ahead of the trip 404 — a parity shift somebody made on purpose — and a Nest guard always runs before the pipe, so converting it silently reverses that ordering. The first attempt also dropped the permission check on DELETE, which the integration suite caught as a 200 where a 403 belonged. places keeps its in-handler check, and README now says why so the next person does not rediscover it the same way. collab applies the guard per handler for the same reason files does: its note-file upload route would otherwise be refused before multer had read the body, and a response sent mid-upload destroys the socket. Two coverage notes. The per-domain thresholds are regenerated because deleting a well-covered helper lowers a file's ratio without anything becoming less tested — the drops are 0.4 to 1.2 points across six domains and match the helpers removed. And the atlas integration suite gets the same admin1-bundle warm-up the unit suite got: ATLAS-013 was paying 3.1s for the one-off decompression inside its own 5s budget, which is why it only ever failed under load. It now runs in 116ms.	2026-08-09 19:46:00 +02:00
Maurice	fef338091c	Fold backupService into the backup domain ... src/services/backupService.ts moves to src/nest/backup/backup.impl.ts, imported only by its own domain now that the controller reaches it through BackupService. src/services/ is down to airtrail/. It stays a module of free functions rather than becoming methods on the service. The restore path closes and reinitializes the core DB handle, which is the single most dangerous sequence in the server, and rewriting its shape in the same step as the move would make a regression there impossible to bisect. The db-lifecycle question is the last step of this fold, not part of it. The move also pulled 512 lines out of ungated src/services/ into a gated domain, which is how the per-domain ratchet caught that the per-entry extraction loop had no tests at all: the zip-slip refusal, the running decompressed-byte cap (the declared size in the central directory is attacker-controlled, so only the running total catches a lying archive), a corrupt stream not being dressed up as a size refusal, and the reopen failure that has to report restart-required rather than success. Six cases now cover it, and backup goes from 84% to 96% statements.	2026-08-09 18:44:59 +02:00
Maurice	f72aba0c91	Finish the plugin RPC decorator rollout ... The last 20 wire methods move onto the decorators: db.* and the three unconditional methods (DbRpc), meta.* (MetaRpc) and the host-mediated surface of users/broadcasts/notify/ai/oauth/scheduler (HostSurfaceRpc). That closes the ledger at 113/113, so the legacy has() blocks in rpc-host.ts are gone and the router is down to what was never domain-specific: build the granted subset of the dispatch map, dispatch, audit, map errors. PluginHostDepsFactory was the 26-argument wiring sheet behind those blocks. With the handlers in the domains it has two dependencies left, so it is now PluginRpcHostFactory: the plugin's own sqlite handle, the inter-plugin router bound with this plugin as the caller, and the audit sink. The 18 host-to-plugin hook calls get the same treatment. They used to spell out the fn name and the timeout at each controller, which meant nothing checked that a hook:* grant on the consent screen had a consumer behind it, that the fn matched what the SDK documents, or that two call sites agreed on the budget. PluginHooks declares all 18 with @PluginHook and performs them, and the controllers call it by name. With both halves complete, requireTotalCoverage goes on: a KNOWN_METHOD without a handler, or a hook without a consumer, now fails app boot instead of surfacing as a PERMISSION_DENIED nobody can explain.	2026-08-09 17:38:56 +02:00
Maurice	aa4ed69677	refactor(server): give trek_photos its own repository ... photoResolverService was two files in one. One half registers and drops rows in trek_photos and touches no photo provider at all; the other dispatches a stream or an info lookup to immich or synology. Keeping them together meant every consumer that only wanted to store a row - the unified trip-photo service, the journey service - dragged both providers in behind it. The storage half becomes TrekPhotosRepository in nest/photos, over DatabaseService. That is also where the photos/ vs memories/ line belongs: storage here, provider dispatch with memories. photos.bridge.ts serves the two modules still in services/ that register rows, and dies with them. Every statement moved verbatim, including the two rules worth stating out loud: getOrCreate re-encrypts a passphrase onto an existing row rather than inserting a second one, and deleteIfOrphan never deletes a local photo, because its bytes are ours and the file would outlive the row.	2026-08-08 22:27:56 +02:00
Maurice	ac96644508	refactor(server): fold the notifications domain out of services/ ... Four files taken apart rather than moved, because they only worked as a knot. The mailer becomes its own leaf module. AuthService sends the password-reset mail while NotificationsModule imports AuthModule for the demo gate in NotificationsMcp - a mailer inside the notifications domain would have closed a hard cycle that only a forwardRef could open again. Webhook and ntfy stay with notifications; auth has no business importing them. The channel registry stays a module singleton and does NOT become a provider. PluginRuntimeService pushes its channel getter in at onModuleInit, and notifications.bridge.ts builds its own NotificationsService for the scheduler crons and the memories senders. A provider would hand the bridge a second, empty registry - every plugin channel would then go quiet with no error anywhere. CHOVR-015 drives that seam end to end: a channel published through the runtime, delivered through the bridge. Nothing pinned it before; the existing cases all set the source themselves. The built-ins no longer self-register by side-effect import. They used to exist only because notificationPreferencesService happened to `import './notifications/builtins'`; removing that line would have silenced email, webhook and ntfy without a failure. They are built from the injected transports and registered from NotificationsService's constructor, so both instances have them. No cached nodemailer transport: MailerService.createTransport re-reads the SMTP config and skipTlsVerify per send, exactly as the three inline call sites did, so an admin changing them does not have to restart. Preferences become a provider over DatabaseService. Eight places built NotificationsService by hand, so a tests/helpers/notifications.ts factory keeps the next constructor parameter a one-file diff instead of an eight-file one.	2026-08-08 12:09:56 +02:00
Maurice	03493a2edd	refactor(server): fold webauthn, account erasure, oauth and the wiki out of services/ (#1840) ... * refactor(server): move the webauthn config and the account erasure into nest/auth webauthnConfig resolved the RP ID through its own getSetting() on the db singleton; it is a WebauthnConfigService over DatabaseService now, injected into AuthService (passkey_configured) and PasskeyService (four ceremonies). readEnv() is still read per call, so an operator flipping the RP ID at runtime takes effect on the next ceremony instead of after a restart. userCleanupService follows as UserCleanupService. It keeps taking removeUserFromBudgetItems from budget.bridge rather than injecting BudgetService: BudgetModule imports AuthModule for the demo guard in BudgetMcp, so AuthModule cannot import BudgetModule back, and breaking that edge the other way drags BudgetController, BudgetMcp and its trips.bridge chain into every graph that imports AuthModule. The legacy module had no tests of its own - the erasure only ever ran through AdminService.deleteUser and TripsService.deleteGuest - so USER-CLEANUP-001..009 pin both halves, including the orphan data dir that no permissions row can describe and the all-or-nothing deletion transaction. * refactor(server): fold the oauth 2.1 server out of services/ 694 lines move into OauthService over DatabaseService, AddonsService and AuditService. The thin wrapper that only forwarded is gone, and so is the second path to the MCP addon flag - validateAuthorizeRequest read it through addons.bridge while the wrapper read it through the injected service, which would have let the two drift. The pending authorization codes stay a module singleton in oauth.pending-codes.ts instead of becoming instance state. The SDK still serves /oauth/authorize, /oauth/register and /oauth/consent from its own router, mounted on Express before app.init(), so it reaches the domain through the new oauth.bridge.ts - two maps would break the authorization-code flow silently, since the SDK only ever answers "Authorization grant is invalid.". The import-time sweep keeps its .unref() and is a named function now so a test can drive it. scopes and sessionManager are imported deep, never through the src/mcp barrel: the barrel re-exports revokeUserSessionsForClient and pulls the domain bridges back in, which is the nest -> mcp -> nest cycle. Same comment as admin.service and auth.service carry. The 70 cases of the legacy suite moved over unchanged, bound to a hand-built service. Fifteen more cover what free functions never let anyone reach: the code store at capacity, an expired code, an expired access token, refresh against a public and an unknown client, the RFC 8707 resource checks, and that a code written through the container is read back through the bridge. * refactor(server): move the wiki reader into the help module wikiService had exactly one consumer, HelpController, and touches no database - it stays a plain module rather than becoming a provider, the way auth/ephemeral-tokens.ts does, so the text and asset caches keep being one per process without any ceremony around it. The WIKI_DIR anchor needed one more level: src/services sits three below the repo root, src/nest/help sits four. The existing path-resolution case caught it, which is what it is there for - a wrong anchor makes help degrade to the GitHub fallback without anybody noticing. Also brings the nest README back in line: services/ is down to five top-level files, and the passkey and budget entries no longer point at paths that were deleted since they were written.	2026-08-08 11:14:24 +02:00
Maurice	c7fed4b1f8	refactor(server): make the place-photo cache a provider (#1833) ... The last file in be-places-helpers-fold, and the one that had to be a provider rather than a move: it carries three in-memory structures that only do their job if the process has exactly one of them. recentFailures stops a screenful of markers hammering an API that is down inFlight stops a stampede when several requests miss the same placeId knownOnDisk saves an existsSync per cache hit A second instance gives the stampede guard its own inFlight map, so two simultaneous requests for the same uncached place both call the provider. That is why the scheduler takes this one from the container instead of constructing it: SchedulerDeps gains a placePhotos entry alongside backups, filled from app.get() in index.ts — the shape PR #1827 was built for. The module-scope mkdirSync becomes onModuleInit, and GOOGLE_PHOTO_DIR is read per call through RuntimeEnvService rather than frozen at import. That is not cosmetic: TREK_PLACE_PHOTO_DIR is the seam the tests use to keep off the real uploads tree, and its own test used to have to import the module dynamically to set the variable in time. The __dirname fallback moved a level with the file and is corrected accordingly. Consumers: maps, places and share inject it; places.helpers.reclaimPhotoCache takes it as a parameter, since it is a free function. Six test seams follow. Four path mocks become injected stubs with the same mock functions behind them; the collections case keeps the REAL implementation, because what it asserts is that removeIfUnreferenced counts collection_places as a reference (#1081) — a stub there would assert nothing. The share e2e overrides the provider in its container. services/ is down to 14 top-level files, from 44 when this started.	2026-08-07 20:27:19 +02:00
Maurice	939452f9d8	refactor(server): consolidate trip access and fold the query helpers into the container (#1824) ... * refactor(server): route every trip-access check through DatabaseService Twelve Nest services carry the same verifyTripAccess/canEdit pair. Six already asked DatabaseService.canAccessTrip; the other six went through services/tripAccess, a nine-line re-export of the identical function. Same query, same result, two ways to reach it. All twelve now take the injected route, so services/tripAccess is gone. The bigger duplication was in the types. Thirteen files declared their own `Trip` for the same return value, in three different shapes: NonNullable<ReturnType<typeof verifyTripAccess>> 6x { user_id: number } 4x TripAccess 3x The narrow one is why assignments, days, places and accommodations all wrote `as Trip | null | undefined` on the call — the cast existed to shrink TripAccess down to a local type that was never meant to differ from it. All thirteen now say TripAccess, and the four casts are gone with no other change. middleware/tripAccess.ts goes too: it was already dead in production — nothing under src/ imported requireTripAccess or requireTripOwner, only comments in the services that had absorbed them. Its test went with it. * refactor(server): fold the query helpers and trip joins into the container Two more legacy files whose only reason for staying outside the container was that they predated it. services/queryHelpers.ts held five exports doing two different jobs. Three are the batch loaders that keep the list endpoints off N+1 queries — they hit the database and are now QueryHelpersService over the injected connection, imported by assignments, days, places and share. The other two, formatAssignmentWithPlace and ratingAggregate, touch no database at all; they sat next to the loaders only because the loaders were free functions too. Those stay free functions, in common/rowShape.ts. The README note on the assignments service claimed the loaders had to stay in services/ because the day, share and place services were unmigrated. All three have since moved, so the reason is gone. services/tripMembership.ts becomes TripMembershipService in its own module. It could have folded into auth or trip-invite, but both call it — as do oidc and the plugin RPC host — and putting it in either would have made AuthModule and TripInviteModule import each other. Neither module is @Global, matching PermissionsModule: e2e TestingModules resolve them transitively through each consumer's explicit import. Test seams changed shape accordingly. Two path mocks of services/tripMembership became injected stubs; the trip-invite e2e overrides the provider in the container instead. The oidc test keeps the real implementation, which is what OIDC-SVC-045 was always asserting. ratingAggregate moved out of the ungated services/ tree into the coverage-gated one, so it gets the direct tests it never had — as does the tags/participants pass-through, which two long-dead fixture variables in the moved test file had been waiting for. Also drops four stale comments that outlived their subject: the requireTripAccess middleware they pointed at was deleted in the previous commit.	2026-08-07 16:00:12 +02:00
Maurice	6dda05f672	refactor(server): move the stateless helpers into nest/common (#1823) ... Eight files in services/ hold no state and touch no database: avatarUrl, conflictResult, demo, passwordPolicy, timezoneService, cookie, and the two crypto helpers. They are imported from 65 places, 62 of them already inside src/nest, so having them live in the legacy layer was pure inertia. They stay plain functions rather than becoming providers. Three importers sit outside the container and would have no way to reach an injectable one: db/migrations.ts runs before the app is built, and middleware/auth.ts and middleware/mfaPolicy.ts run beside it. Wrapping these in DI would buy ceremony and nothing else. mfaCrypto and apiKeyCrypto move together into common/crypto — they read the same ENCRYPTION_KEY, and the directory says so. services/ drops from 44 files to 36, 9,870 lines to 8,493. One trap worth recording: src/app-config and src/nest/app-config both exist. cookie.ts imported '../app-config' from services/, which resolved to the former; after the move the same string silently pointed at the latter, which has no readEnv. It is now explicit about which one it wants. Nothing else changes — no signatures, no behaviour, no tests rewritten beyond their import paths.	2026-08-07 15:14:14 +02:00
Maurice	269bd9140f	feat(server): count only started trips as visited in the atlas ... Every country now carries the status of the strongest source it came from: a country reached by both a past and a future trip is visited, one that only appears in upcoming trips is planned. Marking a country by hand still wins over everything, since that is a statement of fact rather than a date. totalCountries drops to the visited ones and totalCountriesPlanned sits beside it; continents and mostVisited follow the same rule. countries[] stays a superset of what it returned before, so an older client keeps painting the map exactly as it did. The endpoint query has to select trip_id to know which trip a leg belongs to, which makes its DISTINCT per trip — the coordinates are collapsed again in JS so the point-in-polygon lookup still runs once per location.	2026-08-03 20:21:18 +02:00
jubnl	00447c9043	feat(server): validate notification request bodies ... notifications.dto.ts wraps the @trek/shared request schemas via createZodDto and types all five @Body() params; the five NotificationsController entries leave the body-contract allow-list (ratchet gate enforced). Contract catch: the client sends server/token: null on test-ntfy to mean 'use the saved value', so testNtfyRequestSchema gains .nullable() there (spec pinned). The inline response-enum and url-type checks die — malformed bodies now get the pipe's standard envelope; valid bodies behave byte-identically. Two integration cases pinning pre-ratchet tolerances (flat notify_* preferences body, body-less test-smtp POST) update to the current wire contract.	2026-08-02 11:36:36 +02:00
jubnl	d203d8cccd	chore: move notifications backend to proper DI ... The send() dispatcher (services/notificationService.ts) and the in-app store (services/inAppNotifications.ts) fold together into the DI-native NotificationsService over DatabaseService + RealtimeService; the prefs matrix, transports, channel registry and inAppNotificationActions stay plain infra modules. A 1-export notifications.bridge covers scheduler, legacy adminService/memories and the six lazy fire-and-forget sends; AdminController and the plugin RPC host (24th factory dep) inject. The 5-tool registrar + notifications-in-app resource move to notifications.mcp.ts. Tests move with case IDs preserved (NSVC-*, INOTIF-*, + NSVC-020 bridge pin); ~18 suites repoint path mocks/warm-ups; the module e2e goes DI-native. Also carries the verified-quirk fixes that would normally trail as a separate fix(server) commit (file-overlap with the fold): toUtcIso on all three created_at paths (INOTIF-013/014), respond claims the response CAS before running the action handler with release-on-failure (INOTIF-011/012), synology's fire-and-forget send gains .catch, the dispatch-failure log unwraps Error messages (NSVC-021), and the MCP resource description drops its false 'unread first' claim.	2026-08-02 11:36:06 +02:00
jubnl	ec0709741a	chore: move oidc backend to proper DI	2026-08-01 18:25:28 +02:00
jubnl	45564b0a8a	chore: move auth backend to proper DI ... Fold the 1497-line services/authService.ts into the DI-native nest/auth domain (Wave-5 chain opener, unblocked by the atlas fold): - Pure crypto half (backup-code hash/match/generate, stripUserForClient, key masking, the import-time DUMMY_PASSWORD_HASH timing equaliser and avatarDir mkdir — documented parity exceptions) moves verbatim to the plain module nest/auth/auth.helpers.ts. - DB half folds into AuthService over DatabaseService + injected PermissionsService (ex permissions.bridge) + AtlasService (ex atlas.bridge, deleted on schedule). mfaSetupPending and the per-email reset throttle stay module-scoped so the bridge and container instances share them; avatarDir and require('../../../package.json') re-anchor one directory deeper — with the two injection swaps, the only non-verbatim lines. Controller-facing method surface unchanged. - New 8-export auth.bridge.ts for out-of-container consumers: mcp/index.ts token verification, the journey/notifications/transports registrars' isDemoUser, and the still-legacy adminService/oidcService/passkeyService. - 15 domain *.mcp.ts demo guards now inject AuthService (their modules import AuthModule); atlas.mcp.ts alone stays on the bridge because AuthService injects AtlasService and the reverse module edge would close an AuthModule<->AtlasModule cycle (places.mcp precedent). OidcService and PasskeyEnabledGuard inject AuthService too. - Tests move with case IDs preserved: authService.test.ts -> auth.helpers.test.ts, authServiceDb.test.ts -> auth.service.test.ts (+ AUTH-BR-001..007 bridge delegation, + AUTH-DB-050..088 pinning the previously untested getAppConfig/login/MFA/reset/admin-settings branches now under the src/nest coverage gate). auth.e2e converts DI-native (real bcrypt, real audit rows); oidc.e2e swaps its dead path mock for an instance spy; websocket/integration suites repoint to bridge/helpers. Quirks preserved byte-for-byte (0-coord drop in getTravelStats, un-transactioned registerUser/verifyMfaLogin multi-writes, unguarded revokeUserSessions in deleteMcpToken, current! assertions in updateApiKeys) — fixes land separately.	2026-08-01 17:39:59 +02:00