49 Commits

Author	SHA1	Message	Date
Patrick Plate	6e25914074	feat: wire Documents + Board page buttons, add mock-mode dual operation ... Sprint 12 Phase 1: Golden Test Standard - Documents: React Query, upload/download/delete wired, category colors+icons, table min-widths, data-testid - Board: React Query, create position/elect/remove wired, confirmation dialogs, data-testid - Both pages: mock-mode fallback (works without backend)	2026-06-18 14:43:00 +02:00
Patrick Plate	8c969c610f	feat(sprint10): Phase 4+5 — Frontend import wizard + integration testing ... Phase 4 — Frontend Import Wizard: - bank-import.ts service: types (BankImportSession, BankTransaction, CsvColumnMapping, ImportSessionStatus, MatchStatus) + 12 React Query hooks (sessions, transactions, mappings, upload/confirm/skip/assign/complete) - /finance/import page: 4-step wizard (Upload -> Map -> Review -> Confirm) * Drag-and-drop upload with bank format auto-detect (MT940/CAMT.053/CSV) * CSV column mapping editor (saves as reusable mapping) * Review table with color-coded MATCHED/SUGGESTED/UNMATCHED/CONFIRMED rows, confidence % badges, member-assign Combobox, skip/confirm/bulk-confirm * Completion summary + import history table with resume action - de.json + en.json: full bankImport.* namespace (steps, upload, map, review, complete, history, status, sessionStatus, actions, errors) - Navigation: Finanzen converted to nested submenu (Uebersicht + Import) Phase 5 — Integration Testing: - docker compose down -v + up -d --build (clean rebuild) - Playwright e2e/sprint10-system-test.spec.ts: verifies /finance/import unauthenticated -> /login?callbackUrl=%2Ffinance%2Fimport (PASS) - Backend health + frontend route registration verified Bugfix bundled (blocked backend startup): - PaymentRepository: countOverdueByClubId* queries referenced non-existent Payment.dueDate column (regression from Sprint 9 Phase 6, commit 57f418f). Switched to Payment.periodTo (the implicit due date for billing periods).	2026-06-15 18:33:40 +02:00
Patrick Plate	57f418f7c9	feat(sprint9): Phase 6 — Compliance dashboard, RetentionService, testing ... Backend: - ComplianceDashboardService: traffic-light status per ComplianceArea (KCANG/FINANCE/DSGVO/VEREIN) based on deadlines, payments, board positions - RetentionService: scheduled anonymization of expired member data (KCanG §24, 5 years), with dry-run preview and retention report endpoints - ComplianceDeadlineSeeder: seeds 5 standard recurring deadlines on club creation - ComplianceDashboardController: GET /api/v1/compliance/dashboard, GET /retention, POST /retention/preview - Repository additions: countOverdue, countActive board positions/members Frontend: - /compliance page with traffic-light status cards per area - Overdue deadlines section (highlighted red) with 'days overdue' badges - Upcoming deadlines with 'days until due' badges and 'Complete' buttons - Retention info cards (KCanG §24: 5y, AO §147: 10y, DSGVO: 2y) - Navigation: added 'Compliance-Status' to sidebar under Compliance group - compliance-dashboard.ts service with mock data for dev mode Build verified: pnpm build passes clean.	2026-06-15 14:12:01 +02:00
Patrick Plate	87511e0485	feat(sprint9): Phase 5 — Berichtszentrale, sidebar reorg, dashboard enhancement ... - Sidebar: reorganized into 4 collapsible groups (Betrieb, Kommunikation, Verwaltung, Compliance) - Berichtszentrale: new /reports-center page with report cards grouped by category (Finance, KCanG, DSGVO, Admin), format selector, date range pickers, Behörden-Export dialog with password protection - Dashboard: added Outstanding Payments and Monthly Income KPI cards, Upcoming Events widget, Latest Announcements widget, conditional alert cards - Pricing: fixed mobile overflow at 375px viewport on comparison table - Frontend service: new compliance-reports.ts with React Query hooks for report generation, authority export, and download - i18n: added reportsCenter.* and dashboard widget keys to de.json and en.json	2026-06-15 13:45:48 +02:00
Patrick Plate	2d83c4b8a1	fix: resolve Sprint 8 compilation issues, Docker build green	2026-06-15 09:57:32 +02:00
Patrick Plate	e4698827ee	feat(sprint8): Phase 4 — Dokumentenarchiv + Vorstandsverwaltung ... Backend: - V20 migration: documents table with category, access_level, file storage - V21 migration: board_positions + board_members with term tracking - Document entity + DocumentCategory/DocumentAccessLevel enums - BoardPosition + BoardMember entities - Extended AuditEventType (DOCUMENT_UPLOADED/DELETED, BOARD_MEMBER_ELECTED/REMOVED) - Extended StaffPermission (MANAGE_DOCUMENTS) - Extended NotificationType (BOARD_TERM_EXPIRING) - DocumentService: upload, list, download, delete, storage usage - BoardService: positions CRUD, elect/remove members, current/history - DocumentController: multipart upload, filtered list, download, delete, portal - BoardController: positions, elect, remove, current board, history, portal Frontend: - documents.ts + board.ts service layers - Admin /documents page: grouped by category, upload dialog, filter, download/delete - Admin /board page: current board cards, position management, elect member dialog - Navigation: added Dokumente + Vorstand to sidebar - i18n: documents.* + board.* keys in de.json + en.json	2026-06-15 08:53:38 +02:00
Patrick Plate	b22702317a	feat(sprint8): Phase 3 — Mitgliederversammlung (assemblies, voting, protocol PDF) ... Backend: - V19 migration: assemblies, assembly_agenda_items, assembly_attendees, assembly_votes, assembly_vote_records - Enums: AssemblyType, AssemblyStatus, AgendaItemType, VoteType, VoteDecision, VoteResult - Entities: Assembly, AssemblyAgendaItem, AssemblyAttendee, AssemblyVote, AssemblyVoteRecord - Repositories: Assembly, AgendaItem, Attendee, Vote, VoteRecord - AssemblyService: full lifecycle (create, invite, start, attend, vote, quorum, complete) - AssemblyProtocolService: OpenPDF protocol generation (§147 AO compliant) - AssemblyController: admin + portal endpoints - Extended: AuditEventType, NotificationType, StaffPermission Frontend: - Assembly service with full API client and TypeScript types - Admin assemblies list page with create dialog (agenda builder) - Admin assembly detail page (quorum, agenda, votes, attendees) - Navigation: Versammlungen with Gavel icon (after Finanzen) Legal basis: §32-§40 BGB (Mitgliederversammlung), §147 AO (retention)	2026-06-15 08:39:10 +02:00
Patrick Plate	3211ade5be	feat(sprint8): Phase 2 — Treasury frontend + PDF receipts ... Backend: - ReceiptPdfService: Generates Quittung PDF per payment (OpenPDF, A4) - FinancialReportService: Annual financial report PDF (Jahresabschluss) - FinanceController: Added receipt download, annual report, CSV export endpoints - Portal receipt download with member ownership verification Frontend: - src/services/finance.ts: Complete React Query service (types, hooks, mutations) - /finance: Dashboard with KPI cards, recent transactions, outstanding members - /finance/payments: Payment list with filtering, void, receipt download - /finance/kassenbuch: Kassenbuch ledger with date range, CSV export - /finance/fee-schedules: Fee schedule CRUD with interval management - /finance/reports: Annual report PDF download - /portal/finance: Member self-service balance + payment history + receipts Navigation & i18n: - Added Finanzen (Wallet icon) to admin sidebar - Portal finance page for member payments - Comprehensive de.json + en.json finance keys (~100 translations)	2026-06-15 08:24:43 +02:00
Patrick Plate	cfb38e8fc6	test: authenticated admin E2E suite + accessibility + visual regression baselines ... - Global setup: authenticates as admin, saves storageState for reuse - playwright.config.ts: 3 projects (setup, authenticated, unauthenticated) - authenticated-admin.spec.ts: 16 admin pages tested with real auth session - accessibility.spec.ts: axe-core scans on all admin, public, and portal pages - visual-regression.spec.ts: dark mode baselines for key pages (toHaveScreenshot) - @axe-core/playwright added as devDependency - .gitignore updated: excludes .auth/ and test-results/ Full suite: 262 tests passing (setup:1, authenticated:52, unauthenticated:209)	2026-06-13 22:30:29 +02:00
Patrick Plate	aabde17532	feat(sprint7): Phase 4 — Integration (SMTP, tier enforcement, WebSocket) ... Phase 4 implementation: - 4.1 IONOS SMTP email configuration (production + docker profiles) - 4.2 Portal navigation update (info board, events, forum links) - 4.3 Tier enforcement: PlanTierService (forum=Pro+, info board limits) - 4.4 WebSocket real-time updates (WebSocketEventPublisher) - 4.5 EmailService: notification, event reminder, info board templates + rate limiting - 4.6 Enterprise custom FROM: CustomMailDomain entity, DNS verification, controller New files: - PlanTierService: tier checks for forum/info board/enterprise features - NotificationDispatchService: EMAIL channel dispatch via preferences - WebSocketEventPublisher: STOMP topic push for forum/info board/events - CustomMailDomainService: DNS TXT record verification for custom FROM - MailSettingsController: Enterprise custom domain API endpoints - CustomMailDomain entity + repository - V16 migration: email dispatch index - V17 migration: custom_mail_domains table - Frontend: use-forum-subscription + use-info-board-subscription hooks - Portal navbar: added info board, events, forum navigation items - i18n: added portal nav translations (de + en) Also fixed pre-existing Phase 2.5/3 compilation issues: - Member entity: added userId field - AuditService: added convenience overloads (logEvent, 4-param log) - AuditEventType: added INFO_BOARD_POST_UPDATED, INFO_BOARD_POST_DELETED - QuotaViolationCode: added TIER_UPGRADE_REQUIRED - StaffPermissionChecker: added requirePermission(UserDetails, ...) - TenantContext: added getCurrentTenantId() alias - MemberRepository: added findByUserId, findByClubId, findAllByClubId - EmailServiceTest: updated for new constructor signature	2026-06-13 20:51:10 +02:00
Patrick Plate	a539ed9eb2	feat(sprint7): Phase 3 — Forum MVP ... - Flyway V15: forum_topics, forum_replies, forum_reactions, forum_reports tables - Enums: ForumTargetType, ReactionType, ReportStatus - Extended AuditEventType with FORUM_REPLY_CREATED, FORUM_REPORT_REVIEWED - Entities: ForumTopic, ForumReply, ForumReaction, ForumReport - Repositories: ForumTopicRepository, ForumReplyRepository, ForumReactionRepository, ForumReportRepository - ForumService: full CRUD, moderation (lock/pin/delete), 60-min edit window, toggle reactions, content reporting, notifications on new topics/replies - ForumController: admin + portal endpoints (topics, replies, reactions, reports, moderation) - Frontend: forum.ts service with React Query hooks (admin + portal) - Frontend: Admin forum page with topic list, moderation actions (lock/pin/delete) - Frontend: Portal forum page with topic list, reply thread, reactions, report - Navigation: added Forum with MessageSquare icon - i18n: forum.* keys in de.json and en.json	2026-06-13 20:31:17 +02:00
Patrick Plate	05fd679c4d	feat(sprint7): Phase 2.5 — Club Event Calendar ... - Flyway V14: club_events + event_rsvps tables with reminder_sent tracking - Enums: EventType, RsvpStatus, RecurrenceRule + extend AuditEventType/NotificationType - Entities: ClubEvent (extends AbstractTenantEntity), EventRsvp (unique event+member) - Repositories: ClubEventRepository, EventRsvpRepository with date-range and status queries - EventService: CRUD, RSVP with maxAttendees enforcement (409 if full), iCal RFC 5545 generation, recurring event virtual expansion, notifications on create/cancel, auto-post to Info Board - EventReminderScheduler: hourly check, 24h reminder to ACCEPTED/MAYBE attendees - EventController: admin CRUD (MANAGE_INFO_BOARD permission), portal upcoming events, RSVP endpoint, iCal download (text/calendar), attendee list - Frontend: events.ts service (React Query hooks matching apiClient pattern), admin calendar page (month grid with event dots, create dialog, event cards), portal events page (RSVP buttons, capacity display) - Navigation: added Kalender with Calendar icon - i18n: events.* keys in de.json and en.json - UI: added @radix-ui/react-switch + Switch component	2026-06-13 20:16:56 +02:00
Patrick Plate	4aa27cd4f9	feat(sprint7): Phase 2 — Info Board (Schwarzes Brett) ... Backend: - V13 Flyway migration: info_board_posts, post_attachments, post_read_status tables - InfoBoardPost entity with category enum (EVENT, RULE, GENERAL, MAINTENANCE) - PostAttachment entity (table created, upload deferred to later) - PostReadStatus entity with composite key (post_id, member_id) - InfoBoardPostRepository with paginated queries + unread count - InfoBoardService: CRUD, pin/archive, mark-as-read, notification dispatch - InfoBoardController: admin CRUD + portal read/unread endpoints - Integration with NotificationService and AuditService Frontend: - info-board.ts service with React Query hooks for all endpoints - Admin Info Board page at /info-board with create dialog, filters, pin/archive/delete - Navigation: added 'Schwarzes Brett' to admin sidebar - i18n: added infoBoard.* keys to de.json and en.json - Fixed pre-existing prettier issues in notification-compose.ts - Fixed BufferSource type issue in push-subscription.ts	2026-06-13 19:41:20 +02:00
Patrick Plate	706a6e257b	feat(sprint7): Phase 1 — notifications enhancement + push infrastructure ... Phase 1 (Notification Enhancement): - Extended NotificationType enum (ADMIN_MESSAGE, INFO_BOARD_POST, FORUM_REPLY, FORUM_MENTION) - Extended StaffPermission enum (SEND_NOTIFICATIONS, MANAGE_INFO_BOARD, MODERATE_FORUM) - Extended AuditEventType with Sprint 7 events - Flyway V11: notification_sends + notification_send_recipients tables - NotificationSend + NotificationSendRecipient entities - NotificationSendRepository + NotificationSendRecipientRepository - Extended NotificationService with sendBroadcast() and sendToSelected() - NotificationComposeController (POST /compose, GET /sends) - ComposeNotificationRequest DTO Phase 1B (Push Infrastructure): - Flyway V12: device_tokens + notification_preferences tables - DeviceToken entity + DevicePlatform enum - NotificationPreference entity + NotificationChannel enum - DeviceTokenRepository + NotificationPreferenceRepository - DeviceRegistrationService (register/unregister/list devices, max 10 per user) - NotificationPreferenceService (get/create defaults, update, IN_APP always on) - NotificationDispatchService (multi-channel fan-out: WebSocket, Web Push, FCM, Email) - WebPushSender (VAPID-based, simplified for MVP) - FcmPushSender (graceful degradation if not configured) - PushPayload DTO - DeviceRegistrationController (POST/GET/DELETE /devices, GET /vapid-key) - NotificationPreferenceController (GET/PUT /preferences) - ConsentType extended (NOTIFICATION_PUSH, NOTIFICATION_EMAIL) - TargetType enum (ALL, SELECTED) Frontend: - Updated sw.js with push event handler + notification click handler - push-subscription.ts (subscribeToPush, unsubscribe, permission helpers) - notification-compose.ts service (compose, sends, devices, preferences APIs) - i18n keys (de.json + en.json) for compose, preferences, push, devices Configuration: - application-docker.properties: VAPID + FCM push config properties - MemberRepository: added findAllActiveUserIds() for broadcast	2026-06-13 19:25:19 +02:00
Patrick Plate	329b7abb18	fix: replace shadboard.svg with Cannabis leaf icon from lucide-react ... Uses the same Cannabis icon as the login page for consistent branding. Removed unused next/image imports.	2026-06-13 17:53:02 +02:00
Patrick Plate	7fe8d4f707	fix: rebrand Shadboard → CannaManage, staff permissions UX ... - Sidebar, footer, bottom-bar-header: replaced 'Shadboard' with 'CannaManage' - Footer: removed 'Designed by Qualiora' attribution - Staff permissions: single-column layout, alphabetically sorted by label - Edit permissions dialog: useEffect syncs state when dialog opens (fixes pre-fill not working when controlled externally)	2026-06-13 17:45:31 +02:00
Patrick Plate	9aaf771469	fix: consent banner fails open on API error (500/403) ... The consent check endpoint (/consent/check) returns 500 via the proxy when the backend returns 403 (missing JWT forwarding). Previously this caused the banner to show permanently since consentCheck was undefined. Now isError = true hides the banner (fail-open strategy — don't block users when backend is unavailable).	2026-06-13 17:30:19 +02:00
Patrick Plate	27690a836e	fix: consent banner dismiss on decline + short viewport layout ... Bug 1: Clicking 'Ablehnen' now properly dismisses the dialog by calling the delete account mutation and signing out (previously it redirected to /settings/privacy which re-rendered the banner in a loop). Bug 2: Restructured the dialog layout with flex-col + overflow-y-auto on the content area only. Header and action buttons are pinned (shrink-0) so they're always accessible on short viewports. Added max-h constraint with min() to cap at 600px or 90vh.	2026-06-13 17:11:20 +02:00
Patrick Plate	cd77eb6448	fix: correct BCrypt hash in seed SQL and fix Playwright test selectors ... Root cause: The BCrypt hash in init.sql was the famous Stack Overflow hash of 'password' (a0), not the hash of 'test123' as documented. Also fixed three test issues in system-test.spec.ts: 1. waitForURL regex /dashboard|\//' matched any URL with '/' (instant resolve) → replaced with predicate that waits for URL to not contain /login 2. Reports locator used invalid Playwright selector syntax → fixed to use proper :has-text() selector for 'Berichte' 3. Navigation test used 'nav a' but app uses shadcn data-sidebar → broadened selector to include [data-sidebar] a 4. Console error filter excluded only favicon/maps/hydration → also exclude 'Failed to load resource' and 'MISSING_MESSAGE' (pre-existing issues from incomplete API endpoints)	2026-06-13 17:01:56 +02:00
Patrick Plate	4be9c4cf2c	fix(frontend): resolve app-wide 'Oops' crash + PWA middleware interception ... Root cause (found via Playwright browser probe — curl could not detect client-side hydration errors): 1. ROOT-LAYOUT INTL CRASH (the 'Oops' on every page incl /login): app/layout.tsx renders global client components (PwaInstallPrompt → useTranslations, Toaster, Sonner) as siblings of {children} inside <Providers>, but only each route-group layout wrapped its own children in NextIntlClientProvider. So those global components mounted with NO intl context → 'No intl context found' → React hydration crash → global-error 'Oops'. Fix: wrap the root body in NextIntlClientProvider via getMessages() (RootLayout now async). Nested providers stay valid (next-intl supports nesting). 2. PWA MIDDLEWARE INTERCEPTION (manifest.json syntax error + stale cache): middleware matcher did not exclude /manifest.json or /sw.js, so unauthenticated browsers got 307→/login (HTML) for both. Browser parsed HTML as JSON ('manifest.json:1 Syntax error') and an HTML/old service worker kept serving stale bundles ('website hasn't changed' after redeploys). Fix: exclude manifest.json, sw.js, icons, offline from the matcher. 3. SERVICE-WORKER STALE CACHE: bump CACHE_NAME v1→v2 so the activate handler purges old cached bundles from clients that loaded the broken build. Also adds scripts/debug/dashboard-probe.mjs — a Playwright probe that logs in and captures real client-side console/network errors + screenshot.	2026-06-13 10:36:09 +02:00
Patrick Plate	281adda27c	fix(frontend): align NextAuth authorize() with flat backend LoginResponse ... Login reached the backend (HTTP 200) but NextAuth returned CredentialsSignin. Cause: authorize() read data.member.id/email/clubName/clubId, but the backend LoginResponse is flat — { accessToken, refreshToken, expiresIn, role } with no member object. Accessing data.member.id on undefined threw, so authorize() returned null. Decode the JWT payload to recover identity claims (sub=userId, email, tenant_id=clubId) and use the flat top-level role. Adds a small decodeJwtPayload helper (claims only, no signature verification needed here).	2026-06-13 10:10:48 +02:00
Patrick Plate	f6a7143d1b	fix(frontend): guard metadataBase against undefined BASE_URL ... Root cause of the SSG/page-data build crash: src/app/layout.tsx evaluated new URL(process.env.BASE_URL) at module load. BASE_URL was never set as a build-time ENV, so it was undefined -> ERR_INVALID_URL, input: 'undefined'. Because this is the root layout, its metadata is collected for every route, explaining why both /impressum (marketing) and /portal-login (non-marketing) failed identically. The earlier NextAuth/middleware/force-dynamic fixes could not help because metadata evaluation happens before any of that. - layout.tsx: fall back to http://localhost:3000 when BASE_URL is unset - Dockerfile: add BASE_URL build-time placeholder (matches AUTH_URL pattern)	2026-06-13 09:44:21 +02:00
Patrick Plate	9a4df56eaf	fix(frontend): exclude marketing routes from NextAuth middleware matcher	2026-06-13 09:39:17 +02:00
Patrick Plate	b57be8a4d8	fix(frontend): hardcode build-time placeholder ENVs for AUTH_URL/SECRET	2026-06-13 09:34:20 +02:00
Patrick Plate	3e4fdee05b	fix(frontend): force-dynamic on marketing layout to skip SSG at build time	2026-06-13 09:31:24 +02:00
Patrick Plate	805bc4f00d	fix(frontend): add AUTH_URL + AUTH_SECRET build ARGs for NextAuth v5	2026-06-13 09:30:13 +02:00
Patrick Plate	d650987b9a	fix(frontend): guard redirect callback against undefined url during SSG	2026-06-13 09:28:52 +02:00
Patrick Plate	106229e0e3	fix(frontend): add build-time ARG placeholders for NEXTAUTH_URL/SECRET/BACKEND_URL	2026-06-13 09:27:01 +02:00
Patrick Plate	1e693e3d2a	feat(sprint-6): Phase 7 — Launch checklist, pricing page, legal templates ... - docs/sprint-6/launch-checklist.md: comprehensive pre/post-launch checklist - /pricing: public pricing page (Starter €19, Pro €49, Enterprise) - /impressum, /datenschutz, /agb: legal page templates (placeholder text) - (marketing) route group: public layout without auth - Footer links to legal pages on login + portal - i18n for marketing namespace (de + en) - Fix pre-existing lint errors (unused vars, missing @stomp/stompjs types)	2026-06-12 23:16:47 +02:00
Patrick Plate	599514c0db	feat(sprint-6): Phase 6 — Notifications (WebSocket) + PWA ... - WebSocket: Spring STOMP + SockJS, NotificationService, persistent notifications table - NotificationController: GET/PUT endpoints for notification management - Frontend: notification bell with unread badge, dropdown panel, real-time via STOMP - PWA: manifest.json, service worker (manual sw.js), offline page, install prompt - PWA icons (192+512), dark theme colors, standalone display - Full i18n (de/en) for notifications and PWA - Flyway V10 migration for notifications table - spring-boot-starter-websocket dependency added	2026-06-12 23:02:44 +02:00
Patrick Plate	076fd6f9b3	feat(sprint-6): Phase 5 — Full grow calendar (sensors, photos, feeding, harvest traceability) ... - V9 migration: grow_entries, grow_stage_logs, sensor_readings, grow_photos, feeding_logs - 5 entities + GrowStage enum (7 stages) + SensorReadingType enum - GrowCalendarService: CRUD + stage advancement + harvest-to-batch linking - GrowCalendarController: 8 endpoints (/api/v1/grow/*) - Frontend: /grow list + /grow/[id] detail (timeline, sensor charts, photo gallery, feeding log) - Sensor chart (Recharts line: temp + humidity over time) - Harvest completion links grow entry → batch (full traceability) - React Query hooks for all grow operations - Full i18n (de/en) with 7 grow stage labels - Sidebar navigation updated with Anbau/Grow entry	2026-06-12 22:51:45 +02:00
Patrick Plate	05933a08ca	feat(sprint-6): Phase 4 — Immutable audit log ... - V8 migration: audit_events table (JSONB metadata, immutable by design) - AuditEvent entity + AuditEventType enum (18 event types) - AuditService: log events, paginated query, PDF export - AuditController: GET /api/v1/audit (paginated, filtered), GET export - AuditEventRepository with JPQL filtered queries - Frontend: /audit-log page (read-only, filterable, timezone-aware) - PDF export button for Behörde inspections - Sidebar: 'Protokoll' under new Compliance section - PdfReportGenerator: generateAuditReport method added - 10-year retention, REVOKE DELETE documented - Full i18n (de/en) with 18 event type translations	2026-06-12 22:40:40 +02:00
Patrick Plate	61e481b37b	feat(sprint-6): Phase 3 — Stripe integration (SEPA + PayPal + Card) ... - V7 migration: subscriptions table with plan tiers - Subscription entity + PlanTier/SubscriptionStatus enums - StripeService: customer creation, checkout, portal, webhook handling - SubscriptionController: /api/v1/billing endpoints - Webhook handler: invoice.paid, payment_failed, subscription.deleted/updated - Plan enforcement: member limit interceptor, trial expiry check - Frontend: /settings/billing page (plan card, usage, upgrade, portal link) - Trial expired banner on all admin pages - React Query hooks (useSubscriptionQuery, checkout/portal mutations) - Stripe Java SDK 28.2.0 - Full i18n (de/en) for billing namespace	2026-06-12 22:31:03 +02:00
Patrick Plate	3232d2f7fd	feat(sprint-6): Phase 2 — DSGVO consent management ... - V6 migration: consents table with audit columns - Consent entity, repository, service (grant/revoke/check) - ConsentController: GET/POST/DELETE consent endpoints - DSGVO export (Art. 15): full personal data JSON download - DSGVO deletion (Art. 17): anonymization + account deactivation - Frontend: consent banner (modal, cannot dismiss), privacy settings page - React Query hooks for consent + DSGVO operations - Full i18n (de/en) for consent and DSGVO namespaces	2026-06-12 22:22:48 +02:00
Patrick Plate	9373c7ad69	fix: address Snyk findings (remove mock password, override vulnerable deps)	2026-06-12 21:05:27 +02:00
Patrick Plate	4d64576f22	test: Vitest setup + unit tests for API client, hooks, services + staff E2E ... - Vitest + React Testing Library + MSW setup - API client: 11 unit tests (fetch, errors, auth header, download, network failure) - Service hooks: 26 tests across members, distributions, stock, dashboard, staff - Custom hooks: 5 debounce tests (timer behavior, reset, custom delay) - Components: 5 tests (offline banner, error boundary with retry) - E2E: staff management page interactions - npm scripts: test, test:run, test:coverage	2026-06-12 20:50:45 +02:00
Patrick Plate	d1487539b6	feat(sprint-5): Phase 7 — System test harness ... - docker-compose.test.yml: full stack test profile with seed + playwright - scripts/seed/init.sql: test data (admin, members, batches, distributions) - scripts/seed/seed.sh: backend readiness validation script - e2e/system-test.spec.ts: full user journey against real/mock stack - package.json: test:e2e, test:system, test:all scripts - scripts/README.md: system test documentation and usage instructions	2026-06-12 20:39:09 +02:00
Patrick Plate	2cc8c89944	feat(sprint-5): Phase 6 — Staff management UI (list, invite, permissions, revoke) ... - /settings/staff: staff account table with role badges + permission chips - Invite sheet: email + role template + 8 granular permission checkboxes - Edit permissions dialog with optimistic update - Revoke access with AlertDialog confirmation - React Query hooks wired (useStaffListQuery, mutations) - Full i18n (de/en), mock fallback, loading skeletons - Sidebar nav updated: Personal → /settings/staff with UserCog icon - Added @radix-ui/react-checkbox + Checkbox UI component	2026-06-12 20:32:54 +02:00
Patrick Plate	ed1efccc90	feat(sprint-5): Phase 5 — Wire reports + portal to React Query ... - Reports: preview queries + apiDownload for PDF/CSV - Portal dashboard: usePortalDashboardQuery with quota fallback - Portal history: usePortalHistoryQuery with month filter - Portal profile: usePortalProfileQuery + useChangePasswordMutation - All pages show loading skeletons, graceful mock fallback	2026-06-12 20:24:11 +02:00
Patrick Plate	be63a84fe8	feat(sprint-5): Phase 4 — Wire distributions + stock to React Query ... - Distribution list: useDistributionsQuery with date filter + member search - New distribution: multi-step with live quota + batch queries + create mutation - Stock page: useBatchesQuery + useRecallBatchMutation (optimistic) - Add batch: useStrainsQuery + useCreateBatchMutation - All pages show loading skeletons, graceful mock fallback	2026-06-12 20:15:26 +02:00
Patrick Plate	b170bb9d87	feat(sprint-5): Phase 3 — Wire dashboard + members to React Query ... - Dashboard: useClubStatsQuery + useRecentDistributionsQuery with fallback - Members list: useMembersQuery with debounced search + pagination - Member detail: useMemberQuery + useUpdateMemberMutation - Add member: useCreateMemberMutation with invalidation - All pages show loading skeletons during fetch - Graceful fallback to mock data when backend unavailable - New useDebounce hook for search input (300ms delay)	2026-06-12 20:07:16 +02:00
Patrick Plate	f42c166329	feat(sprint-5): Phase 2 — React Query API client layer ... - @tanstack/react-query with QueryClientProvider in providers/index.tsx - Typed api-client.ts fetch wrapper with ApiError class + apiDownload - Service modules: members, distributions, stock, reports, dashboard, portal, staff - Offline banner component (onlineManager subscription) - API error boundary with retry button - Loading skeleton components (card, table, chart, form, dashboard) - i18n for error/loading states (de/en)	2026-06-12 19:59:41 +02:00
Patrick Plate	279f2f6de0	feat(sprint-5): Phase 1 — Docker Compose full stack, CORS, Next.js upgrade ... - Dockerfile.backend: multi-stage Java 21 build (eclipse-temurin) - docker-compose.yml: PostgreSQL 16 + backend + frontend with health checks - SecurityConfig: CORS for localhost:3000 frontend origin - application-docker.properties: Docker profile with env vars - Spring Boot Actuator health endpoint enabled - Next.js upgraded 15.2.8 → 15.5.18 (security fixes)	2026-06-12 19:51:24 +02:00
Patrick Plate	dce27a4291	fix: center content alignment on portal and stock pages	2026-06-12 19:01:47 +02:00
Patrick Plate	7f99e11d9f	test: authenticated admin E2E tour with smart mock backend (all pages screenshot) ... - Rewrote e2e/mock-backend.mjs to return valid auth responses (login + refresh) - Created e2e/authenticated-tour.spec.ts that logs in and screenshots all 7 admin pages - Fixed (dashboard-layout)/layout.tsx: added missing NextIntlClientProvider - All pages render error-free in dark mode with mock data - Screenshots: dashboard, members, distributions, distribution/new, stock, stock/new, reports	2026-06-12 18:38:22 +02:00
Patrick Plate	09d5ca6db0	fix: regenerate screenshots from stable server (replace error-state captures)	2026-06-12 18:27:25 +02:00
Patrick Plate	02e4bbad18	test: comprehensive E2E functional test suite (Sprint 4) ... 66 tests across 13 test groups covering: - Login form interactions & validation - Portal login flow - Navigation & layout verification - Theme/dark mode detection - Auth redirect behavior (8 protected routes) - Portal dashboard (quota rings, navbar, footer) - Portal history page - Portal profile page - Cross-page portal navigation - Responsive design (mobile/tablet/desktop) - Accessibility basics (labels, headings, autocomplete) - Error states & edge cases - Portal page content verification	2026-06-12 18:11:47 +02:00
Patrick Plate	f8f562915e	docs: Sprint 4 visual tour with 19 Playwright screenshots	2026-06-12 17:35:39 +02:00
Patrick Plate	fe6e96dd3f	feat: Sprint 4 complete — frontend MVP (admin dashboard + member portal) ... Shadboard starter-kit (Next.js 15 + React 19 + shadcn/ui + Tailwind 4) Sprint 4.a — Admin Dashboard: - Auth: NextAuth.js v5, login page, middleware, token rotation - Dashboard: KPI cards, Recharts stock chart, quick actions - Members: TanStack Table (search/sort/paginate), add/edit forms - Distributions: multi-step form, real-time quota check, history - Stock: batch management, recall dialog, bar chart - Reports: monthly/member-list/recall, PDF/CSV download, preview Sprint 4.b — Member Portal: - Separate route group with top-nav layout (mobile-first) - Quota dashboard with radial SVG progress indicators - Distribution history with month filter - Profile/settings with password change Cross-cutting: - i18n: German (default) + English via next-intl - Dark + light mode (next-themes, user-togglable) - Playwright E2E tests (6/6 green) - Docker multi-stage build (node:22-alpine) - API proxy via Next.js rewrites Tech: Next.js 15.2.8, React 19, Tailwind 4, NextAuth v5, TanStack Table, Recharts, Zod, React Hook Form, Playwright	2026-06-12 17:18:38 +02:00