A circuit with exactly one device row and no fed distribution board is
shown as that row, so its own name was hidden and could drift (e.g.
"Neuer Stromkreis" in the print view). Commands that create or leave
such a circuit, rename its row or unlink its downstream board now set
the circuit name to the row name and store the change as optional
circuitDisplayNames, so Undo restores an overwritten free name exactly.
Migration 0016 aligns existing data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The editor built the circuit-group subtree snapshot without
manualQuantity, while the server compares it with an exact capture that
includes the column. Deleting any group that contained a device row was
therefore rejected with "Circuit-group subtree changed before deletion."
The new integration test builds the snapshot from the real circuit-tree
read model, as the editor does, and deletes the group for a manual row
and for a row with a Revit quantity share.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tsx runs tests without type checking and tsconfig.json covers only src,
so 71 type errors had accumulated unnoticed. tsconfig.tests.json now
checks every test and helper, and npm run typecheck includes it.
Fixtures gain the fields the DTOs have grown since they were written
(manualQuantity, circuit apparent power/cos phi, downstream board loads,
section totals, building, cover and board info fields). Repository
lookups that return "row ?? null" now declare the null in their type,
which their callers already handle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every assert.throws now names the error it expects, so a broken fixture
or an unrelated failure can no longer satisfy a rejection test. Zod
rejections are matched by issue path and code via tests/support/zod-assertions.ts.
Restore snapshot coverage lost with the release baseline: invalid board
floor, room floor and circuit section references and a reserve state
that contradicts the device rows are rejected again under test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
npm audit --audit-level=high war im prepush nach dem Baseline-Rollout rot.
npm audit fix ohne --force, package.json unverändert. Geändert:
- body-parser 2.3.0->2.4.0
- iconv-lite 0.7.2->0.7.3
- zod 4.4.1->4.6.7
Moderat offen (Fix nur per --force bzw. Major): esbuild uuid
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Aus cj/security-baseline 3a23c7a übernommen:
- scripts/security/mutation_check.py: Syntax-/Importfehler aus einer Mutation zählen nicht
mehr als getötet ([UNGÜLTIG]); getötet nur bei echtem Testfehler (pytest, unittest,
node:test spec und TAP), TODO-/SKIP-Tests sind kein Beleg.
- Sicherheitstest-Vorlage: ungültige Eingaben müssen konfiguriert sein (Leerlauf-Sperre).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Aus cj/security-baseline a04c20b übernommen:
- scripts/security/mutation_check.py: Syntax-/Importfehler aus einer Mutation zählen nicht
mehr als getötet ([UNGÜLTIG]); getötet nur bei echtem Testfehler (pytest, unittest,
node:test spec und TAP), TODO-/SKIP-Tests sind kein Beleg.
- Sicherheitstest-Vorlage: ungültige Eingaben müssen konfiguriert sein (Leerlauf-Sperre).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploy auf cj-ki: Web-Container nur noch 127.0.0.1:3090, Caddy über das Docker-Netz,
COOKIE_SECURE=true geprüft.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Julian hat am 17.10.2026 bestaetigt: die Software laeuft nur im eigenen
Team, alle Nutzer sehen alle Projekte. Bevor Externe Konten bekommen, wird
Besitz/Freigabe pro Projekt eingefuehrt. R3 (ASVS-light B1/B2) damit nicht
anwendbar; idorGap-Kommentar und AGENTS.md verweisen auf D1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stand cj/security-baseline: PYTHONDONTWRITEBYTECODE und Cache-Löschung nach jedem
Schreiben (gleich lange Mutationen liefen sonst mit altem .pyc), Testaufruf so
umbrochen, dass noqa/nosec bei 88 Zeichen auf der Aufrufzeile bleiben.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gleich lange Mutationen (z. B. extra="forbid" -> "ignore") liefen mit altem .pyc, weil
Python den Cache nur über mtime in Sekunden und Größe prüft. Jetzt PYTHONDONTWRITEBYTECODE
und Cache-Löschung nach jedem Schreiben (cj/security-baseline).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ohne passende .gitignore machte der Cache den Arbeitsbaum unsauber, kein
Prüfstempel war gültig.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Makefile und scripts/security/stamp.py aus cj/security-baseline, leere
docs/RELEASE-AUSNAHMEN.md, AGENTS.md-Abschnitt zu Stempeln und Release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Update the Test & Security Baseline from cj/security-baseline (364d756):
- make prepush runs only the checks the diff needs (scripts/security/changed_scope.py)
- make weekly = check + trivy-fs, run by the weekly cron on cj-ki
- in git worktrees gitleaks scanned 0 commits and Semgrep ignored .gitignore (.next/); fixed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- log only the error name for rejected 4xx requests (JSON.parse messages
can quote the request body, e.g. a password)
- refuse LB_DATABASE_PATH in production; it is test-only
- fix two stale file references in the skill texts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Same skills in .agents/skills (Codex) and .claude/skills (Claude Code):
codeguard, security-review, dependency-vetting, pre-release-gate,
authz-idor-audit, threat-model-light. Source: cj/claude-skills.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also document that Sec-Fetch-Site is only sent over HTTPS, so plain-HTTP
LAN access relies on SameSite=Lax alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Renumber the users migration to 0013_users so it follows the upstream
0012_good_gateway (logical board feeds); AGENTS.md deferred-work list keeps
both the new feed items and the auth items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security: per-username login throttling, constant-time unknown-user check,
Sec-Fetch-Site CSRF guard for writes, session rotation on login and
password change, absolute session lifetime, sessions ended on reset and
deactivation, last-admin protection, input length caps, ASCII usernames,
clickjacking headers. Covered by tests/authentication.test.ts.
Filter panel: toggle, fields and count share one row to save space.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Square icon-only theme toggle sits next to the Abmelden button in a shared
row, collapsing to just the toggle when the sidebar is collapsed - same
arrangement as pm-app's Sidebar.tsx.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
No self-signup: admins create every account in Config -> Benutzer with a
typed start password; a forced password change gates first use. Session-
cookie auth protects all /api/* routes; /api/users additionally requires
the admin role. See docs/authentication.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
