Die Dateien schalteten die Typpruefung komplett ab und blieben deshalb auch
von ignoreBuildErrors: false unberuehrt -- eine Luecke im gerade erst
geschlossenen Netz.
- calendar-cache.ts brauchte die Ausnahme gar nicht: ohne sie null Fehler.
- microsoft-todo.ts hatte vier Faelle zirkulaerer Typinferenz
(url -> data -> response -> url), aufgeloest durch explizite Annotationen.
- outlook-calendar.ts verbarg einen moeglichen Laufzeitfehler: Der Code
streute response!-Assertions, eine Stelle war vergessen. Statt noch einer
Assertion prueft er jetzt echt, ob nach drei Wiederholversuchen ueberhaupt
eine Antwort vorliegt.
Ausserdem Block I in TODO.md: Hervorhebung des aktuellen Tages im
Spaltenkopf und die Symbole in Kalenderterminen nach oben rechts, beide mit
Fundstelle in globals.css.
Verifiziert: Typecheck 0 Fehler, npm run build Exit 0.
v1.118.2
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
typescript.ignoreBuildErrors steht jetzt auf false. Ein erfolgreicher Build
ist damit wieder ein Beleg dafuer, dass der Code uebersetzbar ist.
Die Ursache der 30-Minuten-Laufzeit war nicht die Groesse von WeeklyView.tsx,
wie ich vermutet hatte, sondern das include-Muster **/* in tsconfig.json. Auf
src/**/* eingegrenzt laeuft der volle Typecheck in 19 Sekunden.
Die sieben gefundenen Fehler:
- notion-calendar.ts rief notion.databases.query() auf. Die Methode gibt es
in @notionhq/client v5 nicht mehr -- die Notion-Anbindung war zur Laufzeit
schlicht kaputt und niemandem aufgefallen. Migriert auf dataSources.query(),
aber mangels Notion-Zugang ungetestet. Gespeicherte Verbindungen enthalten
alte database_ids und muessen neu eingerichtet werden.
- WeeklyView.tsx importierte isAllDayEvent noch aus format statt date-utils
-- mein eigener Fehler aus v1.118.0, der ohne scharfen Typecheck
durchgerutscht war.
- Export-Helfer lagen in einer route.ts, wo Next.js nur Route-Handler
erlaubt; SettingsSidebar importierte sie von dort und zog einen
Server-Handler in den Client-Graphen. Jetzt in src/lib/export-fields.ts.
- push-notifications.ts: BufferSource-Cast fuer applicationServerKey.
- web-push hat keine Typen; lokale Deklaration statt neuer Abhaengigkeit.
Verifiziert: npm run build Exit 0 mit scharfem Typecheck, 63 Unit-Tests gruen.
v1.118.1
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nodes eingebauter Test-Runner mit --experimental-strip-types: keine neue
Abhaengigkeit, keine Browser, keine Datenbank, Laufzeit rund 170 ms.
npm test fuehrt sie aus, npm run test:e2e startet weiterhin Playwright.
Die Tests haben sofort zwei echte Fehler gefunden, die ich beim Auslagern
in v1.117.7 selbst eingebaut hatte:
- isAllDayEvent rief parseCalendarDate ohne Import auf
- resolveViewDays nutzte clampViewDays ohne Import
Beides haette zur Laufzeit einen ReferenceError gegeben. Der Build meldete
nichts, weil typescript.ignoreBuildErrors noch aktiv ist -- genau der Fall,
gegen den C1 laeuft. isAllDayEvent liegt jetzt in date-utils.ts, wo es
thematisch hingehoert; clampViewDays und MAX_VIEW_DAYS in
device-settings.ts, DaysSelector re-exportiert sie.
Geprueft werden ISO-Kalenderwochen gegen bekannte Kalenderdaten, die
Wochenstart-Berechnung inklusive Sonntag-Sonderfall, das Zeitraster, die
12/24-Stunden-Anzeige und der Round-Trip formatDateToISO <-> parseCalendarDate
-- die Bruecke zwischen Datenbank und Anzeige, aus der Ein-Tag-Verschiebungen
entstehen.
Mit npm run build verifiziert (Exit 0).
v1.118.0
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Dritter Schnitt an WeeklyView.tsx (D1):
- src/lib/weekly/device-settings.ts: Cookie-Helfer plus die vier
Schluessellisten, die bewusst nur im Cookie und nicht in der Datenbank
gehalten werden
- src/lib/weekly/format.ts: stripHtml, invertColor, isAllDayEvent,
getSomedaySlotCount
11.655 -> 11.556 Zeilen. Mit npm run build verifiziert (Exit 0).
Damit sind die reinen Funktionen ohne Komponenten-State heraus, insgesamt
11.906 -> 11.556 (rund 3 %). Der Rest ist die Komponente selbst: JSX und
Handler auf gemeinsamem State. Jeder weitere Schnitt braucht echtes
Props-Design statt Verschieben.
v1.117.7
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Zweiter Schnitt an WeeklyView.tsx (D1). 13 reine Funktionen ohne
Komponenten-State: getStartOfWeek, getDayName, getTimeSlots, formatHour,
getWeekNumber, formatCustomHeader und weitere.
11.830 -> 11.655 Zeilen. Mit npm run build verifiziert (Exit 0).
Nebenbefund: getWeekNumber existiert im Projekt dreimal -- hier, in
WeekPrintModal.tsx und in api/user/export-week-view/route.ts. Das Ersetzen
der Duplikate steht in TODO.md; vorher gehoeren die drei Implementierungen
auf Gleichheit geprueft.
v1.117.6
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Erster Schritt der Aufteilung von WeeklyView.tsx (D1). Die sieben gemeinsamen
Typen lagen in der Komponentendatei; SettingsSidebar und GridTaskBlock
importierten sie von dort und zogen sich damit die gesamte
11.900-Zeilen-Komponente in ihren Abhaengigkeitsgraphen.
WeeklyView.tsx re-exportiert die Typen weiterhin, bestehende Importe bleiben
also unveraendert -- kein Anfassen der beiden Importeure noetig.
11.906 -> 11.830 Zeilen. Mit npm run build verifiziert: Exit 0, 36 Seiten
generiert, /tasks unveraendert bei 265 kB.
v1.117.5
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
eslint.ignoreDuringBuilds stand auf true, der Build verschluckte also jede
Lint-Meldung. Im gesamten Projekt gab es genau zwei echte Errors -- beide
"let json" statt "const json" in SettingsSidebar.tsx. Behoben, Schalter aus,
next lint endet mit Exit 0.
Die 695 Warnungen (470 no-explicit-any, 209 ungenutzte Variablen, 11
unvollstaendige Hook-Abhaengigkeiten) blockieren den Build nicht. Die
Hook-Warnungen sind davon die interessantesten, weil daraus echte Bugs
entstehen -- stehen als eigener Punkt in TODO.md.
Naechster Schritt ist typescript.ignoreBuildErrors; der volle tsc-Lauf
dauert wegen WeeklyView.tsx ueber 15 Minuten und laeuft noch.
v1.117.4
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
.env.production.save und .env.local geloescht (per shred ueberschrieben) --
beide waren identische Kopien derselben Zugangsdaten. In deployment-notes.md
und INFRASTRUCTURE_REQUIREMENTS.md sind die Klartext-Werte durch Platzhalter
ersetzt, die Dateien bleiben als Dokumentation lesbar.
Ausserhalb der Git-Historie liegt damit kein Zugangsdatum mehr im Projekt.
Das alte NEXTAUTH_SECRET und SMTP_PASSWORD sind laut Nutzer rotiert und
ausser Betrieb; offen bleibt allein der Status des Datenbank-Passworts
(Pruefbefehl in TODO.md Block F).
v1.117.3
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Das Audit hatte nur src/ nach Passwoertern durchsucht -- zu eng. Betroffen
sind vier getrackte Dateien, nicht eine:
- INFRASTRUCTURE_REQUIREMENTS.md fuehrt das DB-Passwort unverschleiert als
"**Password**: ..." auf, dazu SMTP und NEXTAUTH_SECRET
- deployment-notes.md enthaelt DATABASE_URL und NEXTAUTH_SECRET
- tests/debug/db-connection-test.spec.ts eine Connection-URL samt echter IP
- .env.production.save, der urspruengliche Fund
Die ersten beiden und .env.production.save sind aus dem Index genommen
(lokal bleiben sie), im Testskript ist das Passwort ersetzt. .gitignore
greift jetzt auf .env* statt auf feste Namen -- genau daran war
.env.production.save vorbeigerutscht.
Im Git liegen zwei verschiedene DB-Passwoerter: eines aus dem alten
Docker-Compose-Setup (@db:5432, vermutlich tot), eines aus dem
Supabase-Zugang. Ob letzteres noch aktiv ist, klaert der Pruefbefehl
in TODO.md Block F.
v1.117.2
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Die Anleitung beschrieb Supabase Cloud mit Dashboard-Knopf. Tatsaechlich laeuft
Supabase per Docker auf einem eigenen LXC (scripts/supabase-setup.sh), ohne
Cloud-Dashboard. Der Weg geht ueber POSTGRES_PASSWORD in supabase/docker/.env
plus ALTER USER, mit pg_dumpall als Rueckfahrkarte -- das Passwort steckt an
mehreren Stellen, ein halber Wechsel legt die Datenbank lahm.
Ergaenzt um die Ports und eine ehrliche Einordnung: Die Datenbank hoert auf
einer privaten LAN-Adresse, dieser Schritt hat von den dreien die niedrigste
Prioritaet.
v1.117.1
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Erste Abarbeitung des Repository-Audits (siehe TODO.md).
Sicherheit:
- Rate-Limiting für alle vier Auth-Endpunkte. Sie waren unbegrenzt aufrufbar,
also beliebig viele Mails über den eigenen SMTP-Zugang und beliebig viele
Rateversuche auf Verifizierungscodes.
- Passwort-Reset-Token nur noch als SHA-256-Hash in der Datenbank. Bisher
Klartext: Lesezugriff auf die DB genuegte zur Kontouebernahme.
- Tote Mock-Login-Route entfernt. Sie verglich gegen ein hartcodiertes
Fake-Passwort und war ueber die Middleware-Ausnahme fuer /api/auth/*
ohne Anmeldung erreichbar.
- Passwort-Reset auf bcrypt-Kosten 12, wie beim Signup.
Reparaturen:
- npm test rief jest auf, obwohl es weder Jest-Config noch Jest-Tests gibt.
Zeigt jetzt auf Playwright; jest/ts-jest/@types/jest entfernt.
- Falscher sonar.projectKey im Workflow.
Verifiziert per tsc gegen die geaenderten Bereiche: keine neuen Typfehler.
v1.117.0
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Event titles were coloured with color-mix(... 78%, black), which stayed so
close to the event's own colour that it barely separated from the tinted
background. Mixing 30% of the colour into a dark slate keeps the calendar
colour recognisable while making the text properly legible.
v1.116.4
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The drop preview and the empty-slot input were keyed by date.getDay(), which
is only unique inside a 7-day window. At 21 days every column sharing the
hovered column's weekday lit up — the mirrored drop targets, one per Tuesday.
The invisible half was worse: handleDrop resolved its target with
visibleDays.find(d => d.getDay() === dayOfWeek), so dropping on the second or
third Tuesday scheduled the task on the first one. Both now use the column's
own date; handleDragOver/handleDrop take a Date instead of a weekday number.
Task rendering was already date-based, so only drag state was affected.
v1.115.3
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There were two near-identical update scripts and they drifted: the npm ci fix
from 1.114.1 only ever landed in update-app.sh, so the boot path kept running
npm install. my-weekly-todo-update.service now runs update-app.sh, and
boot-update.sh is a shim kept only so a not-yet-recopied unit still works.
To be usable at boot the script needed three things it did not have:
- Skip the rebuild when HEAD already matches origin/main and a standalone
build exists, so a reboot is not a full rebuild every time (--force
overrides).
- Do not restart PM2 when its daemon is not up yet. At boot this unit runs
before pm2-root.service, and probing with `pm2 describe` would spawn a
stray daemon that races the real service, so it checks the pid file.
- A flock single-instance lock, so a boot run and a manual run cannot install
into the same tree at once.
It also picks up prisma migrate deploy / generate and the .env copy that only
the boot script had. The log moved to /var/log/my-weekly-todo-update.log.
v1.115.2
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The "update on reboot" unit silently did nothing useful. boot-update.sh piped
every command into tee, so `set -e` only saw tee's exit status: a failed
npm install or build left a half-built tree and still logged "Boot update
finished". It also used npm install (rewrites package-lock.json, so the next
git pull aborts), had no GIT_TERMINAL_PROMPT=0, and was not wrapped in a
function even though git pull rewrites it mid-run.
The unit's TimeoutStartSec=300 was the other half: npm ci + prisma generate +
next build takes far longer than 5 minutes in the container, so systemd
SIGTERMed the oneshot mid-install and left a node_modules tree npm could no
longer remove (ENOTEMPTY on rmdir node_modules/date-fns/isEqual).
Also resyncs package-lock.json with package.json, missed in the 1.115.0 commit.
v1.115.1
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
next.config.js sets output: 'standalone', but Next.js does not copy public/
or .next/static/ into .next/standalone — that is a documented manual step.
Skipping it shipped new server code referencing new chunk hashes while the
old chunks stayed in the standalone tree, so those requests 404'd, React
never hydrated, and pages hung on "Loading session..." while the API kept
returning 200.
v1.114.2
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Moves the deploy script off the server and into the repo as
scripts/update-app.sh, with the two fixes made during the v1.114.0 deploy:
- set -euo pipefail, so a failed git pull aborts instead of rebuilding and
restarting PM2 on unchanged code while printing "Update Complete"
- npm ci instead of npm install, which rewrote package-lock.json and left the
tree dirty so the next git pull aborted
The body is wrapped in a main() function because the script lives inside the
checkout it updates, and git pull rewriting it mid-run would leave bash
reading from a stale file offset.
v1.114.1
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Focus Mode now shows a SKIP button that moves to the next task of the day
without completing the current one. Skipped task ids are tracked in
WeeklyView and filtered out of the focus queue, so completing a task still
picks the correct next one; the list is cleared when Focus Mode closes.
The timer resets on each new task, and the button is disabled when no other
task is left for today.
Also drops the standalone "Element Colors" and "Weekend Colors" sections from
Styling settings (those controls live in the CSS Variables panel since
1.113.1) and enlarges the CSS variable swatches.
v1.114.0
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Give the bottom-of-list "Add task..." input a framed background (white
with a subtle border in light mode, slate-800 with a darker border in
night mode) plus a small radius and padding, so it visually matches user
expectations of an input. The inline slot-editor that appears when you
click on an empty slot keeps the transparent look so it blends with the
surrounding task rows.
v1.104.1
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Pull-sync now runs on visibilitychange + window focus (in addition to mount
and the slow 15-min safety-net interval), throttled to one call per 5s. The
moment the user returns to the tab the app reconciles, so an Outlook-side
checkbox/star/title change shows up within a second of refocusing the tab
instead of after a 15-minute wait.
To keep this cheap, the Microsoft Graph delta endpoint
(/me/todo/lists/{id}/tasks/delta) is used when we have a stored deltaToken
for a synced list — typically a few hundred bytes per call when nothing
changed. Tokens are persisted on SomedayList.syncDeltaToken (new column,
migration applied) and refreshed each call. On 410 Gone (token expired
>30 days) we fall back to a full fetch and prime a new chain. Delta also
brings remote deletions (@removed) so they propagate locally without
needing a full list scan.
v1.104.0
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The previous timestamp gate (`if (remoteUpdated <= localUpdated) continue`)
hid genuine remote-side changes because every prior no-op pull bumped
lastSyncedAt to "now", making it newer than the Outlook lastModifiedDateTime
of a subsequent star toggle. Now the pull does a per-field comparison and
only writes lastSyncedAt when at least one field actually changed. Same fix
applied to the Google Tasks pull branch for consistency.
Also run a pull-sync once on mount instead of waiting up to 15 min, so
remote-side changes show up immediately on next page load.
v1.103.2
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- deleteCachedEvent now removes every cached row that belongs to the same
recurring series (master id + all "<masterId>::*" instances + rows whose
recurringEventId matches the master), so deleting "all occurrences" no
longer leaves orphan rows that resurface on the next read.
- getPriorityBadge: surface the yellow star whenever a task is marked
important (e.g. a starred Outlook To-Do task pulled in via sync), even
when the active priority style is Eisenhower / ABCDE / Ivy Lee.
v1.103.1
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Outlook recurring delete: also delete the specific instance after the master
to clean up orphaned first occurrences.
- CachedCalendarEvent gains busyStatus column (migration applied) so showAs
changes from Outlook flow back into the weekly view.
- Outlook create/update now round-trip the full event (busyStatus, visibility,
attendees, reminders, recurrence link) via a shared response mapper.
- MS To-Do importance ('high' star) ⇄ local importance flag in pull-sync,
push-sync, initial import, and local-task POST/PATCH; dueDateTime ⇄
scheduledDate added to pull-sync.
- Local task PATCH now fires a best-effort push to Outlook/Google/Synology so
any field change keeps both sides aligned.
- AnyDay list delete dialog now offers Cancel / hide locally / delete on both
sides; new deleteMsTodoList + deleteGoogleTaskList helpers.
v1.103.0
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Added @react-pdf/renderer for server-side PDF generation.
PDF report (/api/user/export-pdf):
- Indigo cover band: title, user name, period, export date
- Summary cards: total tasks / calendar weeks / projects
- Per-week sections with indigo header bar showing week label + count
- Goal of the week banner (blue left-border callout) when set
- Task table: priority-color dot, title, then selected columns
- Alternating row shading, column headers in grey
- Page numbers in footer
- A4, respects same field selection as CSV
CSV report updated:
- Added 'Goal of the week' as a section marker row (italic prefix)
- weekGoal field is default-on alongside week grouping
Both exports:
- New 'weekGoal' field in EXPORT_FIELDS (default on): shows the weekly
goal text only when the user has customised it (skips default placeholder)
- Language-aware (de/en) labels and date formats
Settings UI:
- Two download buttons: CSV (plain) + PDF (indigo, prominent)
- weekGoal checkbox in field picker grid
v1.93.0
Replace the small grid of ~45 icons with a searchable IconPicker component
featuring ~250 icons from FontAwesome and Material Design Icons. Includes
keyword search, library tabs (All/FA/MDI), and categories covering tech,
home, sports, food, nature, finance, health, and more.
v1.58.0
- Notion OAuth integration: start/callback routes, calendar-events dispatch,
CRUD operations (create/update/delete via Notion API)
- New notion-calendar.ts provider library with database discovery
- Onboarding wizard: expanded to 6 steps (header/tasks/display design),
improved preview fidelity, universal dummy content, Notion in connect step
- Apple Calendar: label changed to "events only", added warning that
Reminders are unsupported since iOS 13 (no CalDAV/API from Apple)
- Fixed 12h time format on now-line, wizard settings apply on completion
v1.57.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Service worker + Web Push API for browser/mobile notifications
- PWA manifest with icons for home screen install (iOS 16.4+)
- Push subscription management (subscribe/unsubscribe API routes)
- Notification toggle in Settings > General
- Push scheduler script (cron) checks cached events and sends
notifications at reminder times, with dedup tracking
- Test notification endpoint at /api/push/test
- Persists reminders in calendar event cache for scheduler access
- New DB models: PushSubscription, SentNotification
- New user field: notificationsEnabled
Setup: generate VAPID keys with `npx tsx scripts/generate-vapid-keys.ts`
and add to .env, then run scheduler via cron every minute.
v1.37.0
Provider icon is now a sibling flex item inside .weekly-task-text
(same level as checkbox), not nested inside the title text span.
Larger size (11px) and higher opacity (0.6) for better visibility.
v1.15.8
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tasks created locally in a synced someday list may not have
externalProvider set (if the sync to Google/etc failed). Now when
moving such a task to a weekday slot, the provider is inherited
from the source list and persisted to the DB.
v1.15.7
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Place the provider logo (Google/Microsoft/Apple/Synology) right after
the task title text so it's always visible and not hidden by the
task-actions toolbar. Only shown on weekday slots, not in someday area.
v1.15.5
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use bottom: 100% instead of fixed top offset so toolbar always sits
above the task regardless of task height.
v1.15.4
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Show provider-specific icons (Google, Microsoft, Apple, Synology) before and after synced task titles
- Fix someday list reorder drag & drop: stable index calculation with drop indicator line
- Prevent dropping someday lists onto day slots (shows not-allowed cursor)
- Hide recurring button for someday tasks
- Fix Google Tasks subtask duplicates by filtering out child tasks from top-level list
v1.15.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Email verification: 6-digit code + one-click link on signup
- SMTP integration with nodemailer (lazy-init, auto-detect TLS)
- Verify-email page with 6 input boxes, paste support, auto-submit
- Resend verification with 60s rate limiting
- Block login for unverified email accounts
- Auto-save settings: debounced 800ms save on all profile changes
- Redirect to calendar settings after OAuth connection
- Fix Google Calendar connection display after connecting
- Task actions hover toolbar: fix z-index/overflow clipping on first row
- Make day header sticky with proper stacking context
