Maurice 803a7cb64a fix(oidc): bind the SSO auth code to the browser that earned it ...

The callback hands the finished login back as a code in a redirect URL,
and /exchange turned any code into a session. That made the code the
whole credential while it travelled somewhere URLs are readable: browser
history on a shared machine, a referrer, a reverse proxy log. It cuts
both ways. Redeem a code you saw over someone's shoulder and you are
them; or complete a login as yourself, hand the victim's browser your
code, and they are silently signed into your account and write their
next trip into it.

The callback now also sets a one-minute httpOnly cookie holding a random
secret, and /exchange wants the code plus that cookie. Only the browser
that came back from the provider holds both, which is the same shape the
state cookie already gives the callback. The code is burnt on every
attempt, right or wrong, and an unbound code answers exactly like an
unknown one so presenting one confirms nothing.

2026-09-13 22:03:24 +02:00

..

airports

refactor(server): fold airports and distance, drop the boot-time backfill cycle (#1834)

2026-08-07 21:07:14 +02:00

auth

refactor(server): fold the ephemeral-token store and the in-app action registry (#1836)

2026-08-07 22:18:14 +02:00

booking-import

fix(maps): show OpenStreetMap alongside the index, not instead of it

2026-09-07 14:05:33 +02:00

common

refactor(server): consolidate trip access and fold the query helpers into the container (#1824)

2026-08-07 16:00:12 +02:00

llm-parse

fix(llm): let a model refuse temperature, and say which extractor is installed

2026-09-06 15:03:13 +02:00

notifications

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

place-photos

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

places

refactor(server): move the KML importer and place-image helpers into places/ (#1832)

2026-08-07 19:58:12 +02:00

settings

fix(maps): resolve the Places key per instance, not per whoever is asking

2026-08-17 14:48:23 +02:00

storage

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

trip-membership

refactor(server): delete trips.bridge via leaf membership reads and prompt relocation

2026-08-11 20:28:49 +02:00

unsplash

fix(server): bound every outbound fetch

2026-08-23 11:59:12 +02:00

weather

fix(weather): day-local named anchor, cache ttl and past-days forecast window (#2167)

2026-09-01 17:18:10 +02:00

accommodations.controller.test.ts

test(accommodations): cover the paths the day stop added, and the ratchet fell on

2026-09-13 12:12:38 +02:00

accommodations.service.test.ts

fix(accommodations): a check-in decides where in the day the night sits

2026-09-13 16:06:11 +02:00

addon-guard.test.ts

Put the reservation imports behind one door

2026-08-10 17:08:54 +02:00

addons.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

addons.service.test.ts

fix(collab): close the image upload hole and the guard trap

2026-09-09 00:11:00 +02:00

admin-default-user-settings.controller.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

admin-jobs.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

admin-notification-preferences.controller.test.ts

Give three more admin surfaces back to the domains that own them

2026-08-09 20:54:39 +02:00

admin-packing-templates.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

admin.controller.test.ts

fix(places): say where a result came from, and stop asking questions in the form

2026-09-08 20:41:57 +02:00

admin.service.test.ts

feat(admin): photo providers require the journey addon

2026-09-01 16:19:21 +02:00

admin.version-notification.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

airports.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

app-config.test.ts

feat(server): add nest AppConfigModule bound to @nestjs/config

2026-07-25 15:12:38 +02:00

assignments.controller.test.ts

feat(roadtrip): add daily scheduling and configurable day endings

2026-09-11 22:28:03 +02:00

assignments.service.test.ts

fix(roadtrip): sort a booked night by its check-in, and clear the lint the cut left

2026-09-13 16:19:57 +02:00

atlas-transfer-endpoints.test.ts

fix(atlas): stop counting a connection airport as a country visited

2026-08-17 14:48:23 +02:00

atlas.controller.test.ts

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

atlas.service.test.ts

feat(server): read visits and recorded routes from Dawarich

2026-09-12 23:36:49 +02:00

audit-log.logger.test.ts

fix(server): fix the quirks preserved by the permissions and auditLog DI migrations

2026-07-27 22:34:41 +02:00

audit.service.test.ts

fix(server): tighten the guard, audit and token paths

2026-08-23 11:59:12 +02:00

auth-guard.test.ts

test(auth): passkey controller mocks need request headers now

2026-09-01 17:18:10 +02:00

auth.controller.test.ts

test(auth): cover the api-token routes

2026-08-28 15:23:05 +02:00

auth.helpers.test.ts

refactor(server): move the stateless helpers into nest/common (#1823)

2026-08-07 15:14:14 +02:00

auth.service.test.ts

test(server): cover what this branch added to the pinned domains

2026-09-07 14:05:33 +02:00

auto-backup-settings.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

backup.controller.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

backup.impl.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

budget.controller.test.ts

feat(budget): make a settle-up payment's date editable

2026-09-12 17:33:03 +02:00

budget.service.calc.test.ts

fix(costs): derive the final budget breakdown on the server, in the same cents

2026-09-12 17:33:15 +02:00

budget.service.db.test.ts

test(budget): settled_at through the HTTP pipe

2026-09-12 17:33:04 +02:00

budget.service.test.ts

fix(budget): confine payers, split members and settlement parties to the trip

2026-08-16 23:17:50 +02:00

cache-sweep-jobs.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

calendar.service.test.ts

fix(reservations): a night booked on the form belongs on the drive too

2026-09-13 12:38:21 +02:00

categories.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

categories.service.test.ts

refactor(plugins): wire PluginHostDepsFactory through DI, drop tags/categories bridges

2026-07-26 15:28:55 +02:00

channel-override.test.ts

fix(security): keep the operator's ntfy token in and re-check every redirect hop

2026-09-06 15:02:58 +02:00

channel-registry.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

charging.test.ts

add open charging data and polish roadtrip warnings

2026-09-12 13:25:15 +02:00

city-from-address.test.ts

feat(atlas): search by place, and count cities that are actually cities (#1908)

2026-08-12 14:14:37 +02:00

collab.controller.test.ts

test(collab): cover the image upload path and the spool cleanup

2026-09-09 00:11:00 +02:00

collab.service.test.ts

fix(security): keep the operator's ntfy token in and re-check every redirect hop

2026-09-06 15:02:58 +02:00

collections.controller.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

collections.service.test.ts

feat(collections): a list as a file, so it can leave the instance (#2198)

2026-09-11 14:58:34 +02:00

compare.test.ts

refactor(common): one shared comparator instead of three inline copies

2026-08-25 19:26:38 +02:00

config.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

content-disposition.test.ts

fix(server): unicode-safe content-disposition for gpx, ics, feed and wallet downloads (#2165)

2026-09-01 17:18:10 +02:00

cron-registrar.service.test.ts

refactor(server): move the reminder crons onto the injected notifications

2026-08-10 21:49:27 +02:00

database-service.delegation.test.ts

feat(db): provide better-sqlite3 connection via DI token and complete DatabaseService surface

2026-07-25 18:14:37 +02:00

database-service.test.ts

feat(db): provide better-sqlite3 connection via DI token and complete DatabaseService surface

2026-07-25 18:14:37 +02:00

dawarich-suggestions.service.test.ts

feat(server): read visits and recorded routes from Dawarich

2026-09-12 23:36:49 +02:00

dawarich-sync.service.test.ts

feat(server): read visits and recorded routes from Dawarich

2026-09-12 23:36:49 +02:00

dawarich.client.test.ts

feat(server): read visits and recorded routes from Dawarich

2026-09-12 23:36:49 +02:00

dawarich.controller.test.ts

feat(server): read visits and recorded routes from Dawarich

2026-09-12 23:36:49 +02:00

dawarich.helpers.test.ts

fix(dawarich): a stay's length was sixty times too short

2026-09-13 21:38:20 +02:00

day-boundaries.test.ts

feat(roadtrip): add daily scheduling and configurable day endings

2026-09-11 22:28:03 +02:00

day-notes.service.test.ts

Rich formatting and colours for notes (#1889)

2026-08-11 22:14:12 +02:00

days.controller.test.ts

Rich formatting and colours for notes (#1889)

2026-08-11 22:14:12 +02:00

days.service.test.ts

feat(accommodations): put a booked night on its check-in day

2026-09-13 01:13:25 +02:00

demo-write.test.ts

refactor(server): one addon guard, one demo-mode condition (#1829)

2026-08-07 18:42:53 +02:00

discovery.controller.test.ts

refactor(server): move health, discovery and consent-COOP behind the container

2026-08-11 22:23:51 +02:00

exception-filter.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

exchange-rates.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

features.controller.test.ts

refactor(server): move health, discovery and consent-COOP behind the container

2026-08-11 22:23:51 +02:00

feeds.service.test.ts

Require share_manage for the two public credentials (#1883)

2026-08-11 11:15:32 +02:00

files.controller.test.ts

feat(budget): attach receipts and invoices to expenses

2026-09-08 23:15:26 +02:00

files.service.test.ts

fix(budget): stop receipts deleting files, and share the upload path

2026-09-08 23:15:26 +02:00

geo.nominatim.test.ts

Make a bind failure fatal again, and undo four contract tightenings

2026-08-11 09:58:37 +02:00

google-route.test.ts

add Google Maps route import and plugin corridor search

2026-09-12 12:24:33 +02:00

google-transit.provider.test.ts

feat(transit): let an admin route transit search through Google

2026-09-07 09:01:56 +02:00

gpx-export.helpers.test.ts

fix(server): unicode-safe content-disposition for gpx, ics, feed and wallet downloads (#2165)

2026-09-01 17:18:10 +02:00

idempotency.interceptor.test.ts

fix(server): the second pass over this branch's own fixes

2026-08-23 11:59:12 +02:00

immich.service.test.ts

fix(memories): give the photo picker a chronological order it can rely on

2026-09-08 15:24:21 +02:00

journey-book.service.test.ts

fix(journey,files): close the cross-trip and role holes on the sharing surface

2026-08-23 11:59:12 +02:00

journey-domain.service.test.ts

feat(journey): the enhancements from discussion #2299

2026-09-13 18:45:57 +02:00

journey-share.service.test.ts

fix(journey): the gallery runs in trip chronology instead of upload order (#2200)

2026-09-02 21:06:42 +02:00

journey-stats-trips.test.ts

feat(studio): follow-ups from using Studio on a real journey (#1984)

2026-08-20 15:43:27 +02:00

journey-stats.service.test.ts

feat(studio): filter photos by entry, upload from Studio, and switch stops off

2026-09-03 10:47:08 +02:00

journey-stats.test.ts

feat(studio): filter photos by entry, upload from Studio, and switch stops off

2026-09-03 10:47:08 +02:00

journey.controller.test.ts

feat(journey): the enhancements from discussion #2299

2026-09-13 18:45:57 +02:00

mailer.service.test.ts

fix(notifications): a real send keeps its ten minutes, only the admin test is impatient (#2196)

2026-09-03 13:59:39 +02:00

managed-ext.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed-inert.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed-keys.test.ts

feat(map): amap as map api provider and display template

2026-09-12 18:02:57 +02:00

managed.guard.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

maps-dir.helpers.test.ts

feat(places): import the stops of a shared Google Maps route

2026-09-07 18:36:54 +02:00

maps.amap.test.ts

fix(maps): ask Amap only where Amap can answer

2026-09-12 18:03:11 +02:00

maps.area.test.ts

fix(planner): steady satellite pill, responsive places rail, day-scoped add

2026-09-08 20:41:57 +02:00

maps.autocomplete.test.ts

test(maps): pin the coordinates a suggestion carries

2026-09-09 18:55:31 +02:00

maps.controller.test.ts

test(roadtrip): cover the routing, corridor and panel behaviour

2026-09-07 18:36:54 +02:00

maps.curated-images.test.ts

Ask the sources that know the place before the ones that know the area

2026-08-10 12:24:15 +02:00

maps.geocode.test.ts

fix(planner): steady satellite pill, responsive places rail, day-scoped add

2026-09-08 20:41:57 +02:00

maps.gers-details.test.ts

fix(maps): keep index ids away from Google, and let the area download be big

2026-09-07 14:05:33 +02:00

maps.helpers.test.ts

feat(maps): pass through what OSM knows about a charging station

2026-09-07 18:36:54 +02:00

maps.identity.test.ts

Match a place name across its inflected forms, and forget an empty answer quickly

2026-08-10 12:24:15 +02:00

maps.merge-search.test.ts

fix(maps): stop the index costing a second search, a duplicate and a lost cache

2026-09-07 14:05:33 +02:00

maps.pois.test.ts

fix(planner): steady satellite pill, responsive places rail, day-scoped add

2026-09-08 20:41:57 +02:00

maps.search-merge.test.ts

fix(places): say where a result came from, and stop asking questions in the form

2026-09-08 20:41:57 +02:00

maps.service.test.ts

feat(map): amap as map api provider and display template

2026-09-12 18:02:57 +02:00

mcp-addon-gate.test.ts

refactor(server): providerize the OAuth SDK adapter behind the container

2026-08-11 22:44:20 +02:00

mcp-gated-addons.parity.test.ts

fix(roadtrip): say which filter emptied the list, and stop typing a limit racing itself

2026-09-07 18:36:54 +02:00

mcp-shared.service.test.ts

refactor(server): fold the _shared MCP helpers into an injectable guards provider; delete the last bridge

2026-08-11 23:11:34 +02:00

mcp-transport.service.test.ts

fix(server): tighten the guard, audit and token paths

2026-08-23 11:59:12 +02:00

memories-access.service.test.ts

refactor(server): fold the memories domain into providers

2026-08-08 22:27:56 +02:00

memories.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

memories.helpers.test.ts

fix(memories): give the photo picker a chronological order it can rely on

2026-09-08 15:24:21 +02:00

memories.service.test.ts

refactor(server): fold the memories domain into providers

2026-08-08 22:27:56 +02:00

mfa-policy.guard.test.ts

Enforce the MFA policy as a guard, and stop 403ing public routes

2026-08-10 13:38:26 +02:00

notification-preferences.service.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

notification-transports.test.ts

fix(security): keep the operator's ntfy token in and re-check every redirect hop

2026-09-06 15:02:58 +02:00

notifications.controller.test.ts

fix(security): keep the operator's ntfy token in and re-check every redirect hop

2026-09-06 15:02:58 +02:00

notifications.inapp-prefs.test.ts

refactor(server): fold the notifications domain out of services/

2026-08-08 12:09:56 +02:00

notifications.service.test.ts

fix(security): keep the operator's ntfy token in and re-check every redirect hop

2026-09-06 15:02:58 +02:00

oauth-redirect-uri.test.ts

fix(oauth): accept private-use redirect schemes and loopback ports

2026-09-04 12:15:53 +02:00

oauth-sdk.provider.test.ts

fix(oauth): accept private-use redirect schemes and loopback ports

2026-09-04 12:15:53 +02:00

oauth.controller.test.ts

fix(server): tighten the guard, audit and token paths

2026-08-23 11:59:12 +02:00

oauth.service.test.ts

fix(oauth): accept private-use redirect schemes and loopback ports

2026-09-04 12:15:53 +02:00

oidc-ssrf.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

oidc.controller.test.ts

fix(oidc): bind the SSO auth code to the browser that earned it

2026-09-13 22:03:24 +02:00

oidc.service.test.ts

fix(oidc): bind the SSO auth code to the browser that earned it

2026-09-13 22:03:24 +02:00

packing.controller.test.ts

fix(packing,journey,server): address review findings on the three fixes

2026-09-02 16:21:50 +02:00

packing.service.test.ts

fix(packing,journey,server): address review findings on the three fixes

2026-09-02 16:21:50 +02:00

passkey.service.test.ts

fix(auth): passkey_configured stops advertising the phantom localhost config (#2147)

2026-09-02 21:06:51 +02:00

permissions.service.test.ts

fix(server): tighten the guard, audit and token paths

2026-08-23 11:59:12 +02:00

photo-capture-backfill.service.test.ts

fix(db): stop losing secrets and notes to the boot and migration paths

2026-08-23 11:59:12 +02:00

photo-provider.test.ts

Write the 404 Immich streaming only returned

2026-08-10 17:08:54 +02:00

photo-resolver.service.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

place-enrichment.brand.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

place-enrichment.controller.test.ts

Make the detail column useful for places no encyclopaedia describes

2026-08-10 12:24:15 +02:00

place-enrichment.description.test.ts

fix(maps): name the index as the source, and stop it being asked twice

2026-09-07 14:05:33 +02:00

place-enrichment.service.test.ts

test(server): cover what this branch added to the pinned domains

2026-09-07 14:05:33 +02:00

place-shadow.controller.test.ts

feat(places): record which search result was picked, on this instance only

2026-09-07 14:05:33 +02:00

place-shadow.job.test.ts

feat(places): record which search result was picked, on this instance only

2026-09-07 14:05:33 +02:00

place-shadow.service.test.ts

feat(places): record which search result was picked, on this instance only

2026-09-07 14:05:33 +02:00

places.controller.test.ts

fix(roadtrip): keep the shaping a traveller did, through every path that moves a stop

2026-09-07 18:36:54 +02:00

places.directions.test.ts

fix(places): deleting a place cancels the nights booked at it

2026-09-13 15:36:02 +02:00

places.enrichment.test.ts

chore: move place backend to proper DI

2026-07-30 17:07:12 +02:00

places.helpers.test.ts

feat: six community requests — import dedup, accommodations in the feed, OAuth refresh race, visited-from-trip, journal jumps, phone packing rows (#1915)

2026-08-12 17:43:22 +02:00

places.service.test.ts

fix(places): deleting a place cancels the nights booked at it

2026-09-13 15:36:02 +02:00

platform.controller.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

public-api-scopes.test.ts

feat(api): let public API keys be scoped to single areas

2026-09-12 23:36:09 +02:00

public-api.controller.test.ts

feat(api): let public API keys be scoped to single areas

2026-09-12 23:36:09 +02:00

public-api.guard.test.ts

feat(api): let public API keys be scoped to single areas

2026-09-12 23:36:09 +02:00

public-stats.controller.test.ts

feat(server): read visits and recorded routes from Dawarich

2026-09-12 23:36:49 +02:00

rate-limit.service.test.ts

fix(server): tighten the guard, audit and token paths

2026-08-23 11:59:12 +02:00

realtime.gateway.test.ts

feat(journey): TREK Studio — a photo book designer for Journey (#1973)

2026-08-19 23:36:42 +02:00

realtime.service.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

registration-invites.service.test.ts

Return the registration invites to the domain that consumes them

2026-08-09 22:43:05 +02:00

reminder-jobs.service.test.ts

refactor(server): move the reminder crons onto the injected notifications

2026-08-10 21:49:27 +02:00

reservations.controller.test.ts

fix(reservations): keep every id in a booking inside its own trip

2026-08-23 11:59:12 +02:00

reservations.service.test.ts

fix(reservations): a night booked on the form belongs on the drive too

2026-09-13 12:38:21 +02:00

roadtrip-hazards.test.ts

add roadtrip warning areas and tidy driving settings

2026-09-12 11:23:09 +02:00

roadtrip-planning.test.ts

cover roadtrip MCP authorization and search filters

2026-09-12 16:07:36 +02:00

roadtrip-read-tools.test.ts

cover roadtrip MCP authorization and search filters

2026-09-12 16:07:36 +02:00

roadtrip-router.test.ts

feat(roadtrip): plan and edit trips through MCP without a browser

2026-09-11 23:25:06 +02:00

roadtrip-search.test.ts

add Google Maps route import and plugin corridor search

2026-09-12 12:24:33 +02:00

roadtrip.controller.test.ts

feat(roadtrip): show every change to a road trip live to everyone on it

2026-09-10 21:40:51 +02:00

roadtrip.service.test.ts

feat(roadtrip): show every change to a road trip live to everyone on it

2026-09-10 21:40:51 +02:00

route-inventory.test.ts

fix(feeds): keep subscribable calendars working under default-deny

2026-08-23 11:59:12 +02:00

route-usage.service.test.ts

feat(maps): count how much routing an instance actually does

2026-09-09 14:52:50 +02:00

session-renewal.interceptor.test.ts

feat(auth): sliding session renewal past half the token lifetime (#1927)

2026-08-15 22:48:16 +02:00

settings.controller.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

settings.service.test.ts

fix(maps): let users and admins enter a CARTO API key (#2060)

2026-08-27 12:06:55 +02:00

share.controller.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

share.service.test.ts

feat(share): show a stop and a booking in full on a shared link, and no more (#2320)

2026-09-11 11:01:25 +02:00

smtp-diagnostics.test.ts

fix(notifications): the smtp test names its failure and the log carries it (#2196)

2026-09-02 21:06:42 +02:00

spool-cleanup.interceptor.test.ts

fix(tests): let the spool handler stub carry a payload

2026-09-09 10:11:36 +02:00

strip-html-tags.test.ts

fix: make the app keyboard-reachable, and close four DoS-able patterns

2026-08-25 19:26:38 +02:00

synology.service.test.ts

fix(memories): give the photo picker a chronological order it can rely on

2026-09-08 15:24:21 +02:00

system-notices.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

system-notices.service.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

tags.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

tags.service.test.ts

refactor(plugins): wire PluginHostDepsFactory through DI, drop tags/categories bridges

2026-07-26 15:28:55 +02:00

thumbnail.service.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

todo.controller.test.ts

Replace the copied requireTrip helpers with a TripAccessGuard

2026-08-09 19:13:21 +02:00

todo.service.test.ts

fix(trips): confine assignee writes to the people on the trip

2026-08-16 23:17:50 +02:00

token.service.test.ts

feat(settings): give API keys their own section

2026-08-28 15:23:05 +02:00

transit-itinerary.helpers.test.ts

chore: move transitItineraryService into nest/transit as pure helpers

2026-08-01 12:45:35 +02:00

transit.service.test.ts

feat(transit): let an admin route transit search through Google

2026-09-07 09:01:56 +02:00

travel-stats.service.test.ts

fix(atlas): count only the flights a person is actually on

2026-08-20 18:40:21 +02:00

trek-photo-cache.service.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

trek-photos.repository.test.ts

feat(photos): record when and where a photo was taken

2026-08-18 22:24:29 +02:00

trek-places.client.test.ts

fix(roadtrip): stop one gesture writing twice, and one search running too early

2026-09-07 18:36:54 +02:00

trek-ws-adapter.test.ts

feat(journey): TREK Studio — a photo book designer for Journey (#1973)

2026-08-19 23:36:42 +02:00

trip-access.guard.test.ts

Replace the copied requireTrip helpers with a TripAccessGuard

2026-08-09 19:13:21 +02:00

trip-invite.service.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

trip-members.controller.test.ts

Make ownership a guard instead of four hand-written checks

2026-08-10 13:38:26 +02:00

trip-members.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

trip-owner.guard.test.ts

Make ownership a guard instead of four hand-written checks

2026-08-10 13:38:26 +02:00

trip-read-model.service.test.ts

fix(places): deleting a place cancels the nights booked at it

2026-09-13 15:36:02 +02:00

trips.controller.test.ts

fix(server): unicode-safe content-disposition for gpx, ics, feed and wallet downloads (#2165)

2026-09-01 17:18:10 +02:00

trips.service.test.ts

fix(places): deleting a place cancels the nights booked at it

2026-09-13 15:36:02 +02:00

unified-memories.service.test.ts

feat(admin): photo providers require the journey addon

2026-09-01 16:19:21 +02:00

user-cleanup.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

user-profile.service.test.ts

Feat/storage driver (#1949)

2026-08-22 11:33:55 +02:00

vacay.controller.test.ts

fix(vacay): enforce weekend blocking in toggleEntry service

2026-08-12 00:38:41 +02:00

vacay.service.test.ts

feat(vacay): add manual school holiday calendars

2026-09-12 12:51:27 +02:00

validate-body-contracts.test.ts

fix(server): hold DELETE bodies to the same contract as every other write

2026-08-23 11:59:12 +02:00

validate-managed-routes.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

weather.controller.test.ts

feat(weather): answer for the hour when a past entry carries one

2026-08-18 22:24:29 +02:00

webauthn-config.service.test.ts

fix(auth): fail fast on passkey origins outside the relying party scope (#2147)

2026-09-01 17:18:10 +02:00

wiki.test.ts

fix(server): bound every outbound fetch

2026-08-23 11:59:12 +02:00

wiring.test.ts

Hand the feeds calendar parts instead of a document to re-parse

2026-08-10 13:38:26 +02:00

ws-bind-failure.test.ts

Make a bind failure fatal again, and undo four contract tightenings

2026-08-11 09:58:37 +02:00

zod-pipe.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00