3 Commits

Include renames

Author	SHA1	Message	Date
Hermes	74e21c1edc	[pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring ... - Top-bar calendar widget (status/js/calendar-widget.js): next-appointment display, settings modal with CalDAV/ICS source management and a Test-connection probe. Follows the weather-widget pattern. - Backend routes/calendar.js: sources CRUD (secrets in credential manager, never in responses), aggregated events across sources with per-source error isolation, Radicale provision endpoint, CalDAV discover probe. - src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL, EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap. - src/calendar/caldav-client.js: CalDAV REPORT time-range queries over node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap. - src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash verified byte-for-byte against openssl passwd -apr1 vectors), stores credentials, registers the source. Deploy hook in routes/apps/deploy.js wires any Radicale deployed via the App Selector automatically. - Radicale app template (tomsquest/docker-radicale) in the catalog. - Tests: 32 new (parser unit, provisioner unit incl. openssl vectors, route tests). Full suite 3552 passed; only pre-existing pdf-parse billing/invoice failures remain (proven red at base 448f535). - OpenAPI: 5 calendar paths documented. CHANGELOG entry added.	2026-10-07 19:57:22 -07:00
Hermes	a667de7920	DC-059: Joi validation middleware + schemas for destructive routes ... [grade=B] - New src/utilities/validate.js: validateBody(schema) middleware + 9 schemas (backupConfigUpdate, backupScheduleCreate, backupRestore, backupRestoreFile, appDeploy, appRestore, appRevert, assetUpload, logoUpload) - Uses Joi's authoritative CIDR validator (rejects malformed IPv6 like ::::/64 that the previous hex/colon regex would have accepted) - appDeploy.config uses .unknown(true) for forward-compat with template-specific fields (sslType, dnsType, plexClaimToken, etc.) — preserves fields the live frontend posts, prevents a behavioural regression - appRestore uses Joi.any().custom() so the empty-body semantics hold under middleware stripUnknown (default) — body with extra keys now rejected - Wired into 8 destructive routes: backups schedule/restore/config, apps deploy/restore/revert, assets upload/logo - Duplicate legacy POST /backups/schedule handler (line 519) marked LEGACY with TODO removal note (Express only matches first registration; this handler is unreachable under normal routing) - Removed redundant manual appId check in /backups/schedule (Joi schema enforces it) - Removed unused 'mime' destructure in /assets/favicon (decodeImageData validates MIME internally) - 41 unit tests covering every exported schema + middleware integration - 1539/1539 Jest tests pass, zero new ESLint warnings	2026-08-08 15:39:48 -07:00
Hermes	c1358df0ec	DC-059: claim for Hermes	2026-08-08 15:20:09 -07:00