a71547562e
feat(contacts): add multi-value array validators
...
Add validatePhones, validateEmails, validateAddresses for CardDAV
multi-value contact fields. Validates array structure, required
fields, type checks, and max lengths.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com >
2026-05-04 13:01:22 +02:00
4d3c2688fe
Prevent deletion of family members from contact list
2026-04-28 22:17:21 -03:00
b139eea623
refactor(esm): migrate server and tests from CommonJS to ESM
...
Convert all server/, test, and setup files from require()/module.exports
to import/export syntax. Activate ESM globally via "type": "module" in
package.json and load dotenv via --import dotenv/config in npm scripts.
2026-04-03 23:11:20 +02:00
3b90074723
refactor(logging): replace console.* with structured logger across server
...
Add server/logger.js - zero-dependency, level-based logger that outputs
JSON in production and human-readable format in development. Controlled
via LOG_LEVEL env var (debug/info/warn/error, default: info).
Replaces all 100 console.log/warn/error calls in 14 server files.
2026-04-03 22:05:22 +02:00
91c2e0ad98
fix: address CodeQL security findings (v0.5.2)
...
- Rate-limit SPA fallback route (missing rate limiting on fs access)
- Add csrfMiddleware to all state-changing auth routes (logout, create
user, change password, delete user) — previously bypassed global CSRF
middleware due to router registration order
- Fix incomplete vCard escaping: escape backslashes before other special
characters to prevent injection via contact fields
- Restrict CI GITHUB_TOKEN to contents: read (least privilege)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-01 18:30:03 +02:00
4fe4f6cb38
feat: BL-07–BL-10 — notes search, weather refresh, vCard import/export, PWA offline page
...
- Notes: client-side full-text search bar (filters title + content)
- Dashboard: weather refresh button + 30-min auto-refresh interval
- Contacts: vCard 3.0 export per contact (GET /:id/vcard); vCard import
via file input with client-side parser (FN, TEL, EMAIL, ADR, NOTE, CATEGORIES)
- PWA: /offline.html served when network unavailable; cached in app-shell (sw v20)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-31 10:35:03 +02:00
2e3e67baeb
fix: Error Handling in Backend und Frontend verbessern (Phase 5, Schritt 31)
...
- Backend: JSON-Parse-Error + Payload-Too-Large Middleware in index.js
- Backend: Dashboard äußerer try/catch für db.get()-Fehler
- Backend: contacts/meta Route mit try/catch
- Frontend: try/catch + Toast-Fallback in loadMonth (budget), loadRange (calendar),
loadWeek (meals), loadLists/switchList (shopping), initiales Laden (notes)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-26 00:35:16 +01:00
a787667dcb
fix: Input-Validation auf allen API-Routen vereinheitlichen (Phase 5, Schritt 27)
...
Alle Routen nutzen jetzt das zentrale Validierungsmodul (validate.js):
- Maximale Stringlängen (200 Titel, 5000 Text, 100 Kurztexte)
- Enum-Validation für Kategorien, Prioritäten, Meal-Types
- Datum/Zeit/DateTime-Format-Prüfung
- RRULE-Validation (neue rrule()-Funktion)
- Farbwert-Prüfung (#RRGGBB)
Betroffene Routen: calendar, notes, contacts, budget, shopping, meals.
Tasks-Route um RRULE-Validation ergänzt.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-26 00:23:57 +01:00
74b6e5f078
feat: Phase 3 Schritte 16–18 — Pinnwand, Kontakte, Budget-Tracker
...
Pinnwand (Notes):
- server/routes/notes.js: GET (sortiert: angeheftet zuerst), POST, PUT, PATCH /pin, DELETE
- public/pages/notes.js: Masonry-Grid, Markdown-Light-Renderer (fett/kursiv/Liste),
Farb-Auswahl (8 Farben), helle/dunkle Textfarbe je nach Hintergrund, Pin-Toggle
- public/styles/notes.css: Masonry-Layout, Sticky-Note-Karten, Hover-Aktionen
Kontakte:
- server/routes/contacts.js: GET (Kategorie- + Volltextfilter), POST, PUT, DELETE, GET /meta
- public/pages/contacts.js: Kategorie-Filter-Chips, Echtzeit-Suche, Gruppenansicht,
tel:/mailto:/maps-Links, CRUD-Modal
- public/styles/contacts.css: Toolbar mit Suche, Filter-Chips, Kontaktliste, Aktions-Buttons
Budget-Tracker:
- server/routes/budget.js: GET (Monatfilter), GET /summary (Einnahmen/Ausgaben/Saldo +
Aufschlüsselung), GET /export (CSV mit BOM), POST, PUT, DELETE, GET /meta
- public/pages/budget.js: Monatsnavigation, 3 Zusammenfassungs-Karten, Kategorie-Balken
(reines CSS, kein Canvas), Transaktionsliste, Einnahme/Ausgabe-Toggle, CSV-Download
- public/styles/budget.css: Summary-Cards, Balkendiagramm, Transaktionsliste, Modal
Tests: 34 neue Tests (10 Notes + 9 Contacts + 15 Budget), gesamt 146/146
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-24 21:24:08 +01:00
d49cbe33b3
feat: Phase 1 — Projektstruktur, DB-Schema, Auth-System
...
- Vollständige Verzeichnisstruktur gemäß CLAUDE.md
- Express-Server mit Helmet, Sessions, Rate Limiting, SPA-Fallback
- SQLite-Schema (Migration v1): 10 Tabellen, updated_at-Triggers, Indizes
- Versioniertes Migrations-System (schema_migrations)
- Auth-Routen: Login, Logout, /me, Admin-User-CRUD
- Frontend App-Shell: SPA-Router, API-Client, Design-System (CSS Tokens)
- PWA: Service Worker, Web App Manifest
- Setup-Script für ersten Admin-User (node setup.js)
- DB-Tests mit node:sqlite built-in: 29/29 bestanden
- Docker Compose + Dockerfile + Nginx-Beispielkonfiguration
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-24 14:32:36 +01:00
Ulas Kalayci