7 Commits

Author	SHA1	Message	Date
Hartmut	4a5edeef3e	rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI ... - @capakraken/* → @nexus/* across 12 packages (root + 11 workspaces), 1551 import lines migrated via codemod - User-visible brand strings renamed (emails, page titles, PWA manifest, mobile header, MFA backup-codes header, tooltips, signin page, invite page, weekly digest, install prompt) - TOTP issuer "CapaKraken" → "Nexus" (existing secrets still valid; re-enrollment relabels them in users' authenticator apps) - Function rename: assertCapaKrakenDbTarget → assertNexusDbTarget - LocalStorage migration shim in apps/web/src/app/layout.tsx copies capakraken_* → nexus_* on first load (guarded by nexus_migrated_v1 sentinel; runs once per browser, then never again) - Service-worker cache name capakraken-v2 → nexus-v2 with one-time caches.delete('capakraken-v2') from the same shim - Email-domain fixtures @capakraken.{dev,app} → @nexus.{dev,app} in seed data, e2e specs, SMTP default fallback - Dockerfile.dev / Dockerfile.prod / all .github/workflows/*.yml pnpm --filter @capakraken/* → @nexus/* - README, CLAUDE.md, LEARNINGS.md, all docs/*.md, .env.example, tooling/deploy/.env.production.example brand sweep Phase 1 deliberately leaves untouched (handled in Phase 3 cutover): - PostgreSQL DB name "capakraken" and POSTGRES_USER "capakraken" - Volume names capakraken_pgdata etc. - Compose project name "capakraken" / "capakraken-prod" - db-target-guard default expectedDatabase - env-var CAPAKRAKEN_EXPECTED_DB_NAME - Container DNS names in docker-compose.ci.yml Quality gates green: pnpm typecheck (7/7), pnpm test:unit (7/7), pnpm lint (0 errors), check:exports/imports/architecture all pass. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-21 15:10:44 +02:00
Hartmut	17471af7f8	security: bound Zod inputs, add SSE per-user cap and tRPC body limit (#51, PR #59) ... Closes #51 (ESLint rule + conventions doc remain as follow-up). Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>	2026-04-18 13:53:28 +02:00
Hartmut	435c871e1f	security: implement tickets #28-#35 + architecture decision #30 ... #28 - TOTP rate limiting (verifyTotp): added totpRateLimiter (10 req/30s), throws TOO_MANY_REQUESTS before DB hit; 16 unit tests including rate-limit exceeded + userId key isolation. #29 - /api/reports/allocations role check: only ADMIN/MANAGER/CONTROLLER may access; returns 403 otherwise; 9 unit tests (401 unauthenticated, 403 for USER/VIEWER, 200 for allowed roles + xlsx format). #31 - pgAdmin credentials moved out of docker-compose.yml into env vars; PGADMIN_PASSWORD is now required (:?) to prevent accidental plaintext exposure in committed files. #34 - Server-side HTML sanitization for comment bodies via stripHtml(): strips all tags + decodes safe entities before persistence; 16 unit tests covering passthrough, injection patterns, entity decoding. #35 - MFA setup prompt banner (MfaPromptBanner): shown to ADMIN/MANAGER users without TOTP enabled; user-scoped localStorage snooze (7 days); links to /account/security; accessibility role=alert; 7 structural unit tests. #33 - Auth anomaly alerting cron (/api/cron/auth-anomaly-check): detects HIGH_GLOBAL_FAILURE_RATE and CONCENTRATED_FAILURES in 30-minute window; CRITICAL notification to ADMINs; fail-closed via verifyCronSecret; 10 unit tests. #32 - MFA enforcement policy: added requireMfaForRoles field to SystemSettings schema + Prisma migration; auth.ts blocks login with MFA_REQUIRED_SETUP signal if role is enforced but TOTP not set up; signin page redirects to /account/security?mfa_required=1; settings schema + view model updated; 11 unit tests. #30 - API keys architecture decision documented in LEARNINGS.md; no code written — product decision required before implementation. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-04-01 23:25:06 +02:00
Hartmut	dfa289213c	refactor(web): share allocation workbook export helper	2026-03-31 23:06:21 +02:00
Hartmut	cd78f72f33	chore: full technical rename planarchy → capakraken ... Complete rename of all technical identifiers across the codebase: Package names (11 packages): - @planarchy/* → @capakraken/* in all package.json, tsconfig, imports Import statements: 277 files, 548 occurrences replaced Database & Docker: - PostgreSQL user/db: planarchy → capakraken - Docker volumes: planarchy_pgdata → capakraken_pgdata - Connection strings updated in docker-compose, .env, CI CI/CD: - GitHub Actions workflow: all filter commands updated - Test database credentials updated Infrastructure: - Redis channel: planarchy:sse → capakraken:sse - Logger service name: planarchy-api → capakraken-api - Anonymization seed updated - Start/stop/restart scripts updated Test data: - Seed emails: @planarchy.dev → @capakraken.dev - E2E test credentials: all 11 spec files updated - Email defaults: @planarchy.app → @capakraken.app - localStorage keys: planarchy_* → capakraken_* Documentation: 30+ .md files updated Verification: - pnpm install: workspace resolution works - TypeScript: only pre-existing TS2589 (no new errors) - Engine: 310/310 tests pass - Staffing: 37/37 tests pass Co-Authored-By: claude-flow <ruv@ruv.net>	2026-03-27 13:18:09 +01:00
Hartmut	625a842d89	feat: dashboard overhaul, chargeability reports, dispo import enhancements, UI polish ... Dashboard: expanded chargeability widget, resource/project table widgets with sorting and filters, stat cards with formatMoney integration. Chargeability: new report client with filtering, chargeability-bookings use case, updated dashboard overview logic. Dispo import: TBD project handling, parse-dispo-matrix improvements, stage-dispo-projects resource value scores, new tests. Estimates: CommercialTermsEditor component, commercial-terms engine module, expanded estimate schemas and types. UI: AppShell navigation updates, timeline filter/toolbar enhancements, role management improvements, signin page redesign, Tailwind/globals polish, SystemSettings SMTP section, anonymization support. Tests: new router tests (anonymization, chargeability, effort-rule, entitlement, estimate, experience-multiplier, notification, resource, staffing, vacation). Co-Authored-By: claude-flow <ruv@ruv.net>	2026-03-14 23:29:07 +01:00
Hartmut	dd55d0e78b	chore(repo): initialize planarchy workspace	2026-03-14 14:31:09 +01:00