Maurice
df3edac7b9
* fix(places): match imports on the provider id so renamed places are not duplicated Re-importing a Google Maps list duplicated every place the user had renamed. buildDedupSet only ever collected names and, for unnamed places, coordinates, and isPlaceDuplicate returns on the name before it reaches the coordinate fallback, so a renamed place was findable by neither. The ids were stored all along, and even backfilled onto matched places, they were simply never read. Match on google_place_id / google_ftid / osm_id first, keeping name and coordinates in their old roles below it. Widening the coordinate check instead would have merged the restaurant and the bar in the same building. The collection copy carried a hand-mirrored port of the same predicate; it now uses the shared helpers and gets the fix with them. Closes #1550 * feat(calendar): put accommodations into the subscribed feed as all-day stays A hotel keeps its dates on the linked stay, not on the reservation: the booking form writes reservation_time = NULL for type 'hotel', and day_accommodations carries start day, end day and the check-in/out clock. The feed only ever read the reservation, so a stay showed up once on the arrival day at best, and not at all when it came from the booking form. Join the stay in and emit the reservation as an all-day range over every night, which also keeps it correct when days are reordered later — the dates now come from the day rows rather than from the copy stamped at creation time. Check-in and check-out become their own timed events when the stay records a clock, because an all-day event cannot carry the time you actually need reminding of. The check-in window, when set, becomes that event's DTEND. Closes #1586 * fix(oauth): treat a concurrent refresh as a race, not as a stolen token Refresh rotation is a race by construction. Several MCP clients share one refresh token, both post it within the same second, and the loser was read as a replay: chain revoked, MCP sessions torn down, browser window asking to log in again. That is the daily re-authentication people were seeing, not a short lifetime — access tokens last an hour and refresh tokens roll for thirty days. A revoked refresh token now only counts as a replay once it is outside a 30-second grace window, and only when the rotation that revoked it left a successor still alive. Inside the window the caller gets its own pair branched off the same parent, so both clients walk away with a working token. Explicit revocation leaves no live successor and a chain killed by a real replay has none either, so neither can slip through the window. Closes #1007 * feat(collections): mark a place visited from the trip it belongs to A place saved in several lists had to be opened in each of them to say you had been there, which is the wrong way round: you find out you have been somewhere while looking at the trip, not while browsing the library. The save picker now shows each list's own status and cycles it in place, with one action for "visited, wherever this is saved". The planner's selection bar and the mobile bulk toolbar carry the same thing for a whole selection — select all, one tap, done. Matching happens on the server with the signals findMembership already uses plus the source link a place saved from this trip carries, so a copy renamed inside a list is still found. Lists you may only read are skipped rather than refused; a shared list you cannot edit should not stop you marking your own. Closes #1469 * feat(journey): jump to the top or back to the last entry in a long journal Everything that adds to a journal sits at the top — the entry button, the gallery upload — and where you left off sits at the bottom, so adding one photo to a long journey meant scrolling the whole way twice. Two buttons float over the middle of the feed, clear of the Add Entry column on one side and the reorder arrows on the other, each appearing only when there is more than a screenful to travel in that direction. They live in a zero-height sticky box so they take no layout space and never push the timeline around. While in the header, the status pill also picks up the height of the round buttons beside it. Closes #1088 * fix(packing): give the item name the row back on phones An item name had roughly a third of the row to itself: a spelled-out sharing sentence, an empty weight column and two round action buttons took the rest, so anything longer than a word was cut off. Sharing is now the icon it always was next to a label rather than a sentence in the layout, an unset weight prints nothing instead of a dash, and edit/delete sit behind one overflow button that opens the same inline menu the bag picker already uses. The to-do list needed none of this — it wraps its chips onto a second line already. Closes #1525 * docs(wiki): cover the six community changes - Calendar feeds: accommodations as an all-day range plus check-in/check-out - Collections: setting the visited status from a trip, and how places are matched - Journey: the jump buttons on a long journal - Packing: what the phone row keeps and what moved behind the overflow button - Places: re-importing a list no longer duplicates renamed places - MCP setup: the rotation race no longer ends an OAuth session * test(collections): assert the stored status instead of a private method tests/ sits outside the build tsconfig, so reaching into getPlaceById only showed up in the dedicated typecheck step. Reading the row is the better assertion anyway — it pins what was persisted, not what a getter returns.
6.2 KiB
Calendar Feeds
Subscribe your calendar app to a TREK trip so it stays in sync automatically, instead of importing a snapshot once.
Not the same as the ICS export. The Download ICS action described in Day-Plans-and-Notes writes a one-off
.icsfile that never changes after you import it. A calendar feed is a live URL your calendar re-fetches on its own. Use the export for a frozen copy, a feed for something that keeps up with your edits.
Where to find it
There are two feeds, reached from two places:
- Per-trip feed — in the trip planner, hover the ICS button in the Day Plan sidebar toolbar and choose Subscribe to calendar. (The other entry in that menu, Download ICS, is the one-off export.)
- All-trips feed — on the My Trips dashboard, click the calendar-plus button in the toolbar (Subscribe to all trips).
Both open the same dialog.
Per-trip vs. all-trips
| Per-trip feed | All-trips feed | |
|---|---|---|
| Covers | One trip | Every trip you own or are a member of |
| Calendar name | The trip title | {your username} – All Trips |
| Excludes | — | Archived trips, and trips that ended more than 90 days ago |
| URL | /api/feed/trip/{token}.ics |
/api/feed/user/{token}.ics |
| Token lives on | The trip | Your user account |
The all-trips feed merges every qualifying trip into one calendar, sorted by start date, and de-duplicates the time-zone definitions so each event still resolves to the right local time.
Turning a feed on
- Open the Subscribe to calendar (or Subscribe to all trips) dialog. Opening it only reads the current state — it never mints a link behind your back.
- Click Enable calendar subscription. TREK generates a random token and shows the feed URL.
- Hand the URL to your calendar app with one of the buttons:
- Add to Google Calendar — opens Google's add-by-URL page with the feed pre-filled.
- Add to Apple Calendar / Outlook — a
webcal://link that the OS hands to your default calendar app. - Or copy a link manually — expand this to copy the raw
https://…URL (for a From URL box) or thewebcal://variant.
The URL is built from APP_URL when it is set; otherwise TREK falls back to the host you are browsing from. Set APP_URL behind a reverse proxy so the link is the one your calendar app can actually reach — see Environment-Variables and Reverse-Proxy.
The token, and who can read the feed
The random token in the URL is the credential. The feed endpoint requires no login: anyone who has the link can read the whole trip — every event, note, address, and confirmation detail — without an account. The dialog says as much: Creates a secret link anyone with it can read without logging in. You can turn it off anytime.
Treat the URL like a password. Don't post it in a shared document or a public issue.
Rotating and revoking
Once a feed is enabled, two buttons appear beneath the subscribe links:
- Regenerate — issues a new token. The old URL stops resolving immediately, so every calendar still subscribed to it goes dead and has to be re-added.
- Turn off — clears the token entirely. The URL 404s and no feed exists until you enable one again.
Use Regenerate if a link leaked; use Turn off if you no longer want a public feed at all.
What appears in the feed
The feed carries the same events as the ICS export:
- The trip itself — an all-day event spanning the trip's start and end dates, with the trip description.
- Timed day assignments — one event per place that has a time, using the place name as the title, its address as the location, and its notes in the description. Times are anchored to the place's own time zone.
- A per-day summary event — an all-day event for each day that has untimed places or notes, titled with the day title (or Day N), listing those places and notes in the description.
- Reservations — hotels, restaurants, and transport. Flights and other transport take their start and end from the departure and arrival endpoints, each in its own time zone. Reservations with no placeable date are skipped.
- Accommodations — an all-day event covering every night of the stay, from the arrival day to the departure day, so a hotel sits above those days rather than appearing once on the day you check in. The dates come from the trip days the stay is attached to, so reordering days moves the event with them.
- Check-in and check-out — separate timed events on the arrival and departure days whenever the stay records those times. If you entered a check-in window, its end becomes the event's end time.
Feeds are served with cache headers that tell clients not to cache, plus an hourly refresh hint (REFRESH-INTERVAL / X-PUBLISHED-TTL of one hour). Most calendar apps treat that as a suggestion — Google in particular refreshes on its own schedule, often much slower — so an edit may take a while to show up.
Permissions
No dedicated permission gates feeds. You can manage a per-trip token if you own the trip or are a member of it; anyone else gets a Trip not found. The all-trips feed is always scoped to your own account.
Because the token grants unauthenticated read access, enabling a feed effectively shares that trip's contents with whoever holds the link, regardless of trip roles — see Public-Share-Links for the equivalent trade-off on the sharing side.