Erste drei Punkte aus dem TODO-Block L (Sicherheitsdurchgang vom 12.09.):
- scripts/update-app.sh: kein automatischer "prisma db push --accept-data-loss"-
Fallback mehr, wenn "migrate deploy" fehlschlaegt. Das lief am 11.09. beim
Boot-Lauf tatsaechlich unbeaufsichtigt durch. Ein fehlgeschlagenes Migrate
bricht das Deployment jetzt sauber ab, exakt wie ein fehlgeschlagener Build.
- 14 API-Routen gaben error.message direkt an den Client zurueck (Kalender-
Connect/-Sync, Task-Import/-Sync, Someday-Listen, Datenimport). Neuer Helper
src/lib/api-error.ts (safeErrorMessage): generische Meldung in Produktion,
echte Meldung nur noch lokal. Logging unveraendert in console.error.
- src/lib/email.ts: tls.rejectUnauthorized: false entfernt -- stand seit dem
allerersten Commit unbegruendet drin, produktiver SMTP-Host (Kasserver) hat
ein gueltiges Zertifikat.
Verifiziert: Typecheck, Lint, 79 Unit-Tests, Produktions-Build alle gruen.
v1.123.2
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
API routes (goal, weather, calendar/sync, calendar/events):
- All user lookups now use session email instead of session ID so stale
JWTs after DB restore/migration no longer break requests (P2003 FK error)
WeeklyView QuickSettings sidebar:
- effectiveCellDuration now uses local cellDuration state as fallback
instead of stale profile.cellDuration — slot buttons now actually update
the time grid
- Added 20m slot option to all three button groups (sidebar, header, mobile)
- Added :15/:30/:45 sub-hour slots toggle to QuickSettings sidebar
- Slot controls now highlight using effectiveCellDuration (per-view aware)
- Someday and All-day toggles now use effective value, not global profile
v1.81.15
- Weather API returns empty hourly data (200) when lat/lon not configured,
matching the 502 fix — no more browser console errors for weather
- Calendar sync route falls back to email lookup when session user ID
doesn't match a DB record (handles stale JWT after DB restore/migration)
v1.81.14
- tasks/sync GET: batch Google/Outlook/Synology credential fetches with
Promise.all instead of sequential awaits; move per-list Synology
findMany outside the loop to eliminate N+1
- calendar/sync: replace fire-and-forget background refresh with 800ms
Promise.race so fast refreshes return fresh data without blocking
- Extract icon data to iconRegistry.ts; lazy-load IconPicker via
next/dynamic so picker UI code is deferred until needed
v1.78.0
Users can now create sync rules to automatically sync events between
any two connected calendar providers (Google, Apple, Outlook, Synology).
- New Prisma models: CalendarSyncRule + CalendarSyncMapping
- Sync engine in src/lib/calendar-cross-sync.ts: fingerprint-based
change detection, anti-loop protection, one-way and two-way support
- API routes: GET/POST rules, PATCH/DELETE rule by id, POST run
- CalendarSyncRulesPanel component with rule list, add/edit form,
toggle enable/disable, Sync Now button with result summary
- New "Sync" tab in settings sidebar (between Connections and Account)
- Sync rules run automatically after each forced calendar cache refresh
v1.76.0
Mobile fixes:
- Add viewport meta tag (was missing, causing broken mobile rendering)
- Make header nav controls visible on mobile (opacity-0 group-hover was invisible on touch)
- Add touch swipe gestures for day navigation on mobile
- Fix viewDays responsive override after profile load
Bug fixes:
- Fix goal save (WeeklyView used POST but route only had GET/PUT; fix to use PUT, add POST alias)
- Fix body key mismatch (goal → text) in goal save request
Auth & identity (Task 1):
- Add accountNumber (auto-increment) to User model for stable identity
- Fix OAuth flows: pass user CUID in state instead of email
- Google/Outlook callbacks now look up users by ID, not email
- Non-Gmail users can now connect Google Calendar/Tasks
CalDAV performance (Task 5):
- Embed CalDAV object URL in Apple event IDs (caldav::<url>::<uid> format)
- Delete/update now use O(1) direct URL access instead of O(n) full calendar scan
- Optimistic UI removal on delete (no blocking force-refresh)
- Legacy fallback for old-format IDs during transition
Apple Calendar data (Task 2):
- Pass URL, location, recurringEventId, isRecurring through full pipeline
- Add url, recurringEventId, isRecurring to CachedCalendarEvent schema
- Calendar cache now reads/writes all new fields
Projects (Task 6):
- New Project model (name, icon, color, description, order)
- CRUD API at /api/tasks/projects
- Tasks now support optional projectId with cascading nullify
Quotes (Task 4):
- Curated local quote database (50 quotes, DE+EN) with tag filtering
- Preset quote source APIs (ZenQuotes, Quotable, Forismatic, Type.fit)
Fonts (Task 7):
- FontPicker component with searchable dropdown and live preview
- /api/fonts endpoint (Google Fonts API proxy with 24h cache, fallback to 40 popular fonts)
Quick Settings (Task 8):
- QuickSettingsSidebar component (font size, spacing, show completed, start day, show lines)
- New user preferences: showCompletedTasks, showLines, startDayOffset, quoteSourceUrls
v1.9.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Apple calendar parser now checks ICAL.js isDate flag and emits
date-only strings (YYYY-MM-DD) for all-day events instead of
full ISO datetime — fixes all-day detection in the frontend
- Calendar events mapper routes date-only Apple events to the
date field instead of always using dateTime
- Manual refresh button now sends forceRefresh=true which makes
the sync endpoint wait for live data instead of returning stale cache
- Automatic background syncs still use fire-and-forget for performance
v1.2.2
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds full OAuth2 flow, bidirectional task sync, calendar event CRUD,
caching with background refresh, and shared token management for
Microsoft/Outlook services. Extracts common token refresh logic into
shared outlook-token.ts utility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add soft-delete support for tasks with deletedAt field and migration.
Remove Apple Reminders iCloud integration entirely (API routes, lib,
UI modal, and Python script) in favor of CalDAV approach. Add periodic
pull-sync from Google Tasks every 2 minutes with deletion detection.
Fix orphaned someday task rescue and cross-list task toggle/edit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add Google Tasks integration and Apple Reminders support
- Add task import/export with list management APIs
- Add goal API for weekly goals
- Add German holidays library
- Add ImportListModal component
- Enhance WeeklyView with major UI improvements
- Enhance CalendarSettings with new connection options
- Add external task fields to database schema
- Add Playwright test suites for auth and tasks
- Add iCloud reminders Python scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
