Commit Graph

28 Commits

Author SHA1 Message Date
ulsklyc 7b13275882 Update README.md 2026-04-04 12:54:18 +02:00
Ulas c1176de661 fix(audit): address security audit findings
- Translate German error/warn messages in auth.js to English
- Add CODE_OF_CONDUCT.md (Contributor Covenant v2.1)
- Remove docs/claude-md-migration.md (internal migration artifact)
- Clarify README first-login instruction with credential hint
2026-04-04 01:13:50 +02:00
ulsklyc 2e6fb3de65 Update README.md 2026-04-03 11:14:06 +02:00
ulsklyc fe3853594a Refine README formatting and punctuation
Updated formatting and punctuation in the README file for consistency and clarity.
2026-04-03 11:13:10 +02:00
Ulas 28cf388917 docs: add comprehensive installation guide and link from README
New docs/installation.md covers the full setup journey for Docker
beginners: prerequisites, step-by-step install, .env reference,
Nginx/HTTPS, updates, backup/restore, and troubleshooting.
README Quick Start updated to include clone + .env steps and
links to the detailed guide.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:54:20 +02:00
Ulas 789f07100e docs: refine README structure and Quick Start section
Separate docker compose and setup steps for clarity, remove redundant
horizontal rules, split License into its own section per style guide.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:45:02 +02:00
Ulas f7b9f8c876 docs: overhaul README with modern, concise project presentation
Replace verbose README with a streamlined structure inspired by
Immich/Mealie/LobeChat. Focus on scanability, mobile-first screenshots,
and clear communication of architectural decisions (zero-dependency
frontend, privacy-first, PWA).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:43:19 +02:00
Ulas 922c0b7fd6 chore: add .nvmrc and README sections for API docs and roadmap
- Add .nvmrc (22) for nvm/fnm users
- README: add API section pointing to SPEC.md and server/routes/
- README: add Roadmap section linking to BACKLOG.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 14:19:56 +02:00
Ulas b2fbd11287 fix: add social-preview.png, correct test count, add engines field
- Add social-preview.png to version control (referenced in README but untracked)
- Update README: test count 146+ → 162 across 9 suites
- Add engines.node >=22.0.0 to package.json (required for --experimental-sqlite)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 11:41:34 +02:00
Ulas 617e3cf007 fix: rename screenshots to bust GitHub CDN cache for updated images
Files that kept their original names after content replacement were served
from GitHub's CDN cache. Rename with -2 suffix to force fresh delivery.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 11:33:28 +02:00
Ulas 27bb95fc41 docs: replace screenshots with updated versions, add calendar/meal/settings/shopping
- Remove household screenshots (renamed to shopping)
- Add new calendar, meal, settings, shopping screenshots (mobile + tablet, light + dark)
- Update README screenshot section: 3x3 mobile grid covering all 9 modules, expanded tablet section

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 11:30:44 +02:00
Ulas d543837025 docs: add social-preview banner, i18n badge, and multilingual feature note to README 2026-03-31 23:41:07 +02:00
Ulas 443c8635a5 docs: add project logo and embed in README
Geometric house icon on blue gradient rounded square (SVG).
Replaces shields.io badge placeholder in README hero section.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 17:41:45 +02:00
Ulas be8af0f154 docs: overhaul README for professional project presentation
Restructure README with compelling hero section, "Why Oikos?" philosophy
section, two-column feature grid, tablet screenshot gallery, and streamlined
quick start. Add GitHub Private Vulnerability Reporting link to SECURITY.md.
Include social preview HTML template for GitHub social card generation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 17:34:23 +02:00
Ulas ffa0083892 docs: update SPEC, CONTRIBUTING, README for v0.3.0 and v0.4.0 features
- SPEC.md: add notes full-text search, contacts vCard import/export,
  recurrence_parent_id + budget_recurrence_skipped table, sync_config table
- CONTRIBUTING.md: fix test file location (project root, not tests/),
  add offline.html to project structure
- README.md: Node.js ≥22, Apple CalDAV UI setup (Option A), fix
  Contributing section link, update Notes/Contacts feature highlights

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-31 10:46:49 +02:00
Ulas 5838fb9243 Fix README screenshots: add dark mode support, fix broken image paths, normalize sizing
- Wrap all screenshots in <picture> elements with dark/light source variants
- Replace non-existent mobile-light-shopping.png with mobile-light-household.png
- Replace non-existent tablet-light-calendar.png with mobile dashboard screenshot
- Set consistent width="240" and width="33%" on all mobile screenshot cells

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-29 01:50:28 +01:00
ulsklyc 396050e2cf Aktualisieren von README.md 2026-03-29 01:17:56 +01:00
Ulas 8e01d4c749 Add theme-adaptive screenshots to README and fix manifest icons
Replace old screenshots with new mobile/tablet variants in light and dark
mode. README now uses <picture> elements with prefers-color-scheme so
screenshots automatically match the viewer's GitHub theme. Split manifest
icon purpose field into separate "any" and "maskable" entries per PWA spec.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-29 00:42:24 +01:00
ulsklyc 37da2858c6 Aktualisieren von README.md 2026-03-28 13:18:53 +01:00
ulsklyc ac174906e9 docs: README überarbeitet — Privacy-Fokus, professionelleres Layout
Neuer Abschnitt „Warum Open Source & Privacy?" mit konkreter Darstellung
sensibler Familiendaten (Gesundheit, Finanzen, Kinderdaten). Kompaktere
Modulübersicht, gestraffter Schnellstart, Sicherheitsdetails klappbar.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-26 14:07:30 +01:00
ulsklyc eff3e4bfb2 docs: README komplett überarbeitet — professioneller, anfängerfreundlicher, visuell ansprechender
- Einladender Hero-Bereich mit klarem Value Proposition
- Vergleichstabelle Cloud vs. Selfhosted
- Ausführliche Schritt-für-Schritt-Installationsanleitung mit Erklärungen für Einsteiger
- Expandierbare Details-Blöcke für zusätzliche Hilfe
- FAQ-Sektion für häufige Fragen
- Sicherheitsübersicht als übersichtliche Tabelle
- Bessere visuelle Struktur mit mehr Whitespace und klarerer Hierarchie
- package.json Beschreibung verbessert

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-26 00:46:46 +01:00
ulsklyc e068a14819 docs: README aktualisieren (Dark Mode Toggle, RRULE UI, Input-Validation)
- Dark Mode: Hinweis auf manuellen Theme-Switch in Einstellungen
- Aufgaben/Kalender: Wiederholungen als Feature hervorgehoben
- Sicherheit: Input-Validation und parametrisierte Queries dokumentiert
- Jahreszahl auf 2025–2026 aktualisiert

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-26 00:26:29 +01:00
ulsklyc 49b66ca3e1 docs: Installationsanleitung ausführlicher gestalten
- Schnellstart → detaillierte 6-Schritt-Anleitung mit Erklärungen
- Schlüssel-Generierung mit openssl rand dokumentiert
- Neuer Hinweis: SESSION_SECURE=false für HTTP ohne Reverse Proxy
- Hinweis wann SESSION_SECURE wieder entfernt werden soll (nach SSL-Setup)
- Status prüfen nach Container-Start erklärt
- Konfigurationstabelle um SESSION_SECURE ergänzt
- Updates-Sektion mit Backup-Hinweis

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-25 09:14:32 +01:00
ulsklyc ecc088bd71 docs: Dark Mode Screenshots hinzufügen
5 Dark Mode Smartphone-Mockups (Dashboard, Aufgaben, Kalender, Einkauf,
Essensplan) mit korrekten Dark Mode Design-Tokens (#1C1C1E BG, #2C2C2E
Surface, #AEAEB2 Sekundärtext). README: Getrennte Light/Dark-Tabellen
mit je 5 Screenshots in einer Reihe.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-25 08:15:14 +01:00
ulsklyc 4d933126be docs: App-Screenshots für GitHub README hinzufügen
Smartphone-Mockups für alle 5 Hauptansichten (Dashboard, Aufgaben,
Kalender, Einkauf, Essensplan) mit realistischem iPhone-Rahmen.
README um Screenshots-Sektion erweitert.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-25 00:22:18 +01:00
ulsklyc 0dac77773a security: MIT-Lizenz, .gitignore härten, Fail-Fast für SESSION_SECRET
- LICENSE: MIT-Lizenz (bereits vorhanden, korrekt)
- package.json: "license": "MIT" ergänzt
- README.md: Lizenz-Badge auf MIT aktualisiert, Lizenz-Sektion angepasst
- .gitignore: .claude/ und *.txt hinzugefügt (verhindert versehentliches
  Committen von Claude Code Einstellungen und Token-Textdateien)
- server/auth.js: Fail-Fast in Produktion wenn SESSION_SECRET fehlt;
  Fallback-String auf 'dev-only-secret-not-for-production' umbenannt
  (klarere Intention, kein bekannter Produktions-Wert im Public Repo)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-24 23:01:08 +01:00
ulsklyc 72d6d5126e feat: Schritte 14–15 — Google Calendar OAuth + Apple CalDAV Sync + Settings-Seite
- server/services/google-calendar.js: OAuth 2.0, bidirektionaler Sync via
  Google Calendar API v3, inkrementeller syncToken, 410-Fallback auf Vollsync
- server/services/apple-calendar.js: CalDAV via tsdav (dynamic ESM import),
  minimaler ICS-Parser + ICS-Builder, bidirektionaler Sync
- server/routes/calendar.js: 7 neue Sync-Routen (google/auth, google/callback,
  google/sync, google/status, google/disconnect, apple/status, apple/sync)
- server/db.js: Migration 2 — sync_config Tabelle + idx_calendar_external_id
- server/db-schema-test.js: MIGRATIONS_SQL[2] für Tests synchronisiert
- server/auth.js: PATCH /me/password Endpoint
- server/index.js: Auto-Sync-Scheduler (setInterval, SYNC_INTERVAL_MINUTES)
- public/pages/settings.js: vollständige Settings-Seite (Konto, Passwort,
  Kalender-Sync-Status + Aktionen, Familienmitglieder-Verwaltung)
- public/styles/settings.css: neue Stylesheet-Datei
- public/index.html + public/sw.js: settings.css eingebunden und gecacht
- .env.example: SYNC_INTERVAL_MINUTES ergänzt
- README.md: vollständige Setup-Anleitung, Google/Apple-Sync-Dokumentation,
  modernes GitHub-Layout mit Badges und aufklappbaren Abschnitten

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-24 22:53:44 +01:00
ulsklyc dd8ad80eb4 feat: Phase 5 — Härtung (CSRF, Rate-Limit, Validation, Error Boundary, README)
Schritt 28 — CSRF-Schutz (Double Submit Cookie Pattern):
- server/middleware/csrf.js: generiert 32-Byte-Token, speichert in Session + Cookie;
  validiert X-CSRF-Token-Header auf POST/PUT/PATCH/DELETE via timingSafeEqual
- server/auth.js: CSRF-Token beim Login erzeugen und als Cookie setzen
- public/api.js: getCsrfToken() liest Cookie; apiFetch() sendet Header auf
  state-ändernden Requests automatisch

Schritt 29 — Globaler Rate-Limiter:
- server/index.js: apiLimiter (300 req/min/IP) auf allen /api/-Routen;
  ergänzt den bestehenden loginLimiter (5 req/min)

Schritt 27 — Zentralisierte Eingabe-Validierung:
- server/middleware/validate.js: str(), oneOf(), date(), time(), num(), color(),
  collectErrors() mit einheitlichen Längengrenzen (MAX_TITLE=200, MAX_TEXT=5000)
- server/routes/tasks.js: validateTaskInput() nutzt nun validate.js

Schritt 31 — Frontend Error Boundary:
- public/router.js: window.onerror + unhandledrejection-Handler zeigen Toast

Schritt 33 — README.md:
- Setup-Anleitung (Docker + Node.js), Nginx-Config, User-Verwaltung,
  Umgebungsvariablen-Referenz, Backup, Sicherheitsübersicht

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-24 22:00:47 +01:00