ArbeitszeitCheck - Releases

Added

• Month closure grace period and auto-finalization: Admin setting month_closure_grace_days_after_eom (0–90, default 0). After end-of-month, employees have that many calendar days to finalize manually; if the month is still open afterward, a daily background job finalizes it automatically (same snapshot as manual finalize). Pending time entry approvals and open absence workflow states block auto-finalization. Reopening remains admin-only.
• App-admin allowlist: New admin setting app_admin_user_ids to restrict ArbeitszeitCheck administration to a selected subset of Nextcloud admins. Empty selection keeps backward-compatible behavior (all Nextcloud admins can administer the app).
• Security role-gating Docker test target: Added scripts/test-security-role-gating-docker.sh wiring via make test-security-role-gating-docker and composer test:security-role-gating:docker for fast authorization regression checks in containerized setups.

Changed

• Month closure UX and API: Employee UI uses a clearer card layout, visible feedback for success/errors (WCAG-friendly), server-driven canFinalize with localized block reasons (feature off, future month, pending approvals). Manual finalize rejects future calendar months. Absence workflow (pending, substitute_pending, substitute_declined) is enforced alongside pending time entry corrections. Unauthorized API access returns 401 where appropriate. Admin settings: dedicated “Month closure” section; grace-days field stays editable with copy explaining it is saved even when closure is off; reopen uses searchable employee picker and clearer administrator vs. employee wording. Form validation error callouts use higher-contrast text and tinted surfaces across themes. Auto-finalize job logs per-user failures for operations.
• Release/signing workflow hardened for integrity checks: make release-signed now signs the extracted release archive payload (not the local development checkout), validates forbidden development paths are excluded, and repacks the signed archive for deployment/App Store upload.
• Admin authorization enforcement: Access to AdminController routes now uses middleware-level app-admin checks with a dedicated exception and a consistent 403 response page for authenticated users without app-admin rights.

Documentation

• Deployment guidance: Release docs now explicitly require production deployment from the signed tarball only and document the common integrity-failure pattern (.git/* / node_modules/* lists) caused by signing a dev tree.
• Deployment helper script: Added release/deploy-from-release.sh to deploy from signed release archives with safety checks (forbidden path scan, required signature.json, optional app disable/enable and occ integrity:check-app).
• Admin operations: User/developer docs now describe how to configure app-admin allowlisting, what the default fallback is, and how to verify authorization gating in Docker-based test runs.

Added

• Revision-safe month finalization (optional): Admin toggle month_closure_enabled (default off). Employees can finalize a full calendar month; the app stores a canonical JSON snapshot, SHA-256 hash chain, append-only revision rows, audit events, and a minimal PDF download. Finalized months are read-only through normal app APIs; administrators may reopen a month with a mandatory reason (audit). Monthly reports for a finalized month use the stored snapshot. Database: at_month_closure, at_month_closure_revision (migration Version1014Date20260409120000).

Documentation

• User manuals (EN/DE), developer documentation, and compliance notes updated for month closure, retention context, and limits (in-app tamper evidence, not QES).

Added

• Manager employee absences view: New in-app page and API for managers/admins to review employee absences with secure scope filtering, pagination, and localized status labels.
• Working time model copy flow: Added copy action with modal UX, unique default naming, and safeguards against duplicate submits.

Changed

• Manager navigation structure: Sidebar regrouped into clearer manager/admin submenus; reports moved under manager context; compliance link placement adjusted for reduced top-level clutter.
• Manager employee time entries UX: Date defaults and formatting/translation handling improved for clearer filtering behavior.
• Calendar behavior (rollback cleanup): Removed in-progress direct calendar-write functionality and related admin controls/status/test endpoints. The supported behavior remains unchanged: no Nextcloud Calendar app sync; optional .ics attachments are sent by email for configured absence workflows.

Fixed

• Working time model modals: Corrected copy modal interaction flow, source-model presentation, and delete-confirmation localization/rendering issues.
• Absence iCal hardening: Added stricter status/date guards, recipient deduplication, and privacy-safe event descriptions for substitute/manager recipients.

Documentation

• User manuals and changelogs updated to reflect the final calendar model (email .ics optional, no direct Nextcloud Calendar app sync) and current manager/admin UX structure.

Added

• Vacation rollover: VacationRolloverService, background job, occ arbeitszeitcheck:vacation-rollover, migration Version1013Date20260407120000 with at_vacation_rollover_log; unit tests.

Changed

• Frontend l10n: Shared templates/common/main-ui-l10n.php and teams-l10n.php so translated strings are available early across pages; related template and JS updates.

Fixed

• Manager dashboard — pending absences: API includes summary.typeLabel (server-localized absence type); UI prefers it so cards show translated labels (e.g. German Urlaub) instead of raw codes like vacation.

Documentation

• docs/Developer-Documentation.en.md: pending-approvals API note for typeLabel; user manuals (EN/DE): manager pending approvals show localized absence types.

Added

• Development tooling: occ arbeitszeitcheck:generate-test-data CLI for deterministic demo data (time entries, absences, optional violations, demo app team) to exercise UI, reports, and workflows locally.

Fixed

• Reports UI: Report type cards are no longer incorrectly disabled when a team-related scope is selected (team scopes still use the team report API where applicable).
• Reports (tests): Team report CSV download test now reads download bodies via DataDownloadResponse::render() (Nextcloud API).
• Team reports: Deduplicate user IDs before permission checks and aggregation to avoid double-counting when users appear in multiple teams.
• Absence type badges: Stronger, theme-safe contrast for vacation / sick / home office / other badges (readable on pale Nextcloud palettes).

Changed

• Compatibility (dev): Local development stacks aligned with Nextcloud 33.x (example: official nextcloud Docker image).
• Reports layout: Reverted an overly aggressive “full width” parameter form rule that could interfere with scrolling/layout on the reports page.

Fixed

• Admin settings API URL handling: Prevented duplicate index.php/index.php path generation when a route URL is already pre-generated by Nextcloud.
• Frontend error handling: Avoided unhandled Promise rejections in callback-based Utils.ajax() consumers after expected API failures.

Fixed

• Routing/compatibility: Added indexApi() compatibility aliases for legacy endpoints to prevent 500 errors in the Nextcloud log.
• PHP fatal errors: Fixed constructor signature issues in AbsenceService and ComplianceService that could crash the app when loading services or saving settings.
• Reports security hardening: Hardened report preview endpoints with start <= end validation and a maximum date-range limit to reduce DoS risk from untrusted parameters.
• Admin “whole organization” scope: Correctly handle admin organization scope (userId="" = all enabled users) and enforce access checks so preview/download data stays consistent.
• Reports rendering: Improved Preview rendering for absence and compliance reports to match the actual report data structure.

Changed

• Reports UI semantics: Team scope is limited to the team overview/export semantics that the backend actually returns (prevents misleading previews/downloads).
• Organization download guidance: Added explicit UI messaging for organization scope download limitations until organization-wide export endpoints are implemented.

Fixed

• ArbZG compliance: Corrected break check logic (9h/45min branch now reachable; check ≥9h before ≥6h)
• Manager logic: employeeHasManager() now uses getManagerIdsForEmployee() instead of getColleagueIds()
• Reporting: getTeamHoursSummary() respects period parameter (week/month)
• Admin users: hasTimeEntriesToday is now per-user, not system-wide
• UserSettingsMapper: Fixed falsy zero/empty-string handling in getIntegerSetting, getFloatSetting, getStringSetting
• Routing: Moved exportUsers route above getUser to fix route shadowing
• Version1009 migration: Replaced MySQL backtick SQL with portable QueryBuilder; use OCP\DB\Types
• Duplicate notifier: Removed double registration from Application.php boot()
• API security: Generic error messages instead of raw exception output (SubstituteController, GdprController)
• PDF export: Returns HTTP 422 with clear message instead of silent CSV fallback
• LIKE injection: WorkingTimeModelMapper::searchByName() uses escapeLikeParameter()
• XSS: Modal titles escaped in components.js; compliance-violations.js innerHTML escaped
• Admin-settings form: Added CSRF requesttoken
• AbsenceService DI: Fixed constructor argument order (IDBConnection)
• Admin holidays and settings: English source strings for l10n keys
• UserDeletedListener: inject TeamMemberMapper and TeamManagerMapper
• XSS: sanitise team names in admin-teams.js

Changed

• CSS: Shadow-light variable, scoped resets, dark-mode color-mix fixes, semantic color variables, navigation height/z-index
• Clock buttons: Double-submit guard (disabled during API calls)
• initTimeline(): Max retry count (20) to prevent infinite loop
• Accessibility: aria-label on header buttons, label for admin user search, aria-modal on welcome dialog, English l10n keys in navigation
• Docs: Removed internal docs; added docs/README; corrected repo URLs
• Manager dashboard: Injected l10n from PHP so JS translations work
• Constants.php for magic numbers; user-facing error messages

Added

• Version1010 migration: Compound indices on at_entries, at_violations, at_holidays, at_absences

Changed

• Long-term refactor: Replaced all \OC::$server usage with proper OCP APIs and constructor injection
• CSPService: Injected ContentSecurityPolicyNonceManager via constructor
• Controllers: Removed manual cspNonce (configureCSP handles it); injected IURLGenerator, IConfig where needed
• PageController: Injected IURLGenerator, IConfig; passes urlGenerator to templates
• HealthController: Injected IDBConnection for database check
• ProjectCheckIntegrationService: Injected LoggerInterface instead of OC::$server->getLogger()
• Templates: Replaced \OC::$server with \OCP\Server::get() (OCP public API)
• Added GitHub Actions release workflow (.github/workflows/release.yml)
• Updated PageControllerTest with full constructor mocks

Fixed

• Resolved duplicate route names in absence API (absence#store, absence#show, absence#update, absence#delete)
• Corrected settings class names in info.xml to use full OCA namespace
• Added declare(strict_types=1) to routes.php

Changed

• Removed non-existent screenshot references from info.xml until real screenshots are captured