sami7777/dashcaddy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
681 Commits 43 Branches 13 Tags
b4e09af712403ea727f51b742366f453e0893cb0
Commit Graph
3 Commits
Author SHA1 Message Date
Hermes 3a0f595a17 [grade=B urn:ump:dbxmyhvr7cpkeu3mbfdevrco7utsok743udjsj7atih6qk4frdiq] fix(DC-168): calendar widget CSRF writes, error path, modal UX (audit batch 2) 
Audit 2026-10-27 fixes (46-finding sweep, AUDIT-2026-10-27.md):
- P0-2: all 6 calendar API calls via secureFetch — raw fetch sent no
  X-CSRF-Token so every mutation (save/toggle/delete/test) was rejected
  403 [DC-100]; GETs gain the standard 15s timeout
- P0-6: refresh() catch called nonexistent errorHandler.log() — the
  error path itself threw; now logError(context, error)
- P0-7: modal sizing off inline min-width:560px onto .cal-modal-content
  with 768px override (inline style beat the mobile media query)
- refresh coalescing via _pendingForce (forced refreshes were dropped
  mid-flight); single fetch sequence on modal open; toggle/delete get
  resp.ok + try/catch + toast + disabled-during-flight
- modal on class-based .show: click-outside, Escape, focus move/return
  on all three dismissal paths (judge polish applied)
- chip honors Enter/Space (role=button); poll skips hidden tabs
- --cal-chip-when/--cal-when/--cal-dot re-scoped to :root (were scoped
  to elements that are never ancestors of .cal-dot — DC-168 WCAG dot
  colors never rendered)
- calendar-cache eventKey no longer throws RangeError on invalid start

Bundles rebuilt (sw dashcaddy-shell-7fc13e7762). status suite 68/68.
Judge B (polish items applied pre-commit): urn:ump:dbxmyhvr7cpkeu3mbfdevrco7utsok743udjsj7atih6qk4frdiq
 2026-10-27 23:58:55 -07:00
Hermes dbede032eb [pending-judge] feat(DC-168): calendar widget UX + theming — "No upcoming appointments" state, month grid with highlighted appointment days, theme-correct styling 
Owner directives (2026-10-10/11, verbatim in brief): show "no upcoming
appointments" when empty; show a month calendar with days and times
highlighted when there are events; stylize to fit every theme; keep the
widget weather-widget-sized.

Changes (status/ frontend + tests):
- status/js/calendar-widget.js: rewritten render path — chip states ("No
  upcoming appointments" / next appointment with highlighted when-span),
  month grid modal (cal-grid + prev/next nav, appointment days highlighted,
  per-event time dots), upcoming list with day/time emphasis, month-following
  fetch with window-authoritative event merge (via calendar-cache.js),
  forced refresh on periodic tick + source mutations, local escapeHtml (was
  an undefined global).
- status/js/calendar-cache.js (new): uid+start-keyed event cache; fetched
  window is authoritative for entries starting inside it (deletions and
  reschedules propagate), entries outside survive. Dual export (module +
  window) for tests and browser bundle.
- status/build.js: calendar-cache.js bundled before calendar-widget.js.
- status/css/dashboard.css: DC-168 block — chip states, month grid, day
  highlight states, dots, list/source rows, universal light-bg contrast
  rules (color-mix; WCAG >= 4.5:1 verified for all 10 builtin themes, worst
  4.60:1 ocean) + light-surface rules.

Tests: 20 total in __tests__/calendar — 9 in caldav-default-ns (extraction
incl. mixed docs, empty multistatus, namespace-aware fixture validation,
undeclared-prefix rejection both quote styles, positive declared-attr),
5 in dc168-cache-contract (merge, duplicate suppression, recurring uid+start,
window-authoritative removal on refetch, cross-window survival, ended-
exclusion), 6 in dc168-widget-contract (navigation fetch windows, forced-
refresh semantics, cache+widget integration, interval coverage). Existing
suites pass unmodified; eslint 0 errors on touched files.
 2026-10-12 01:07:53 -07:00
Hermes 74e21c1edc [pending-judge] feat(DC-161): calendar widget + Radicale auto-wiring 
- Top-bar calendar widget (status/js/calendar-widget.js): next-appointment
  display, settings modal with CalDAV/ICS source management and a
  Test-connection probe. Follows the weather-widget pattern.
- Backend routes/calendar.js: sources CRUD (secrets in credential manager,
  never in responses), aggregated events across sources with per-source
  error isolation, Radicale provision endpoint, CalDAV discover probe.
- src/calendar/ics-parser.js: dependency-free RFC 5545 parser with bounded
  RRULE expansion (DAILY/WEEKLY-BYDAY/MONTHLY/YEARLY, COUNT/UNTIL/INTERVAL,
  EXDATE consumes COUNT, RECURRENCE-ID overrides), 500-event cap.
- src/calendar/caldav-client.js: CalDAV REPORT time-range queries over
  node:https (no new deps), HTTPS-enforced off localhost, 5MiB response cap.
- src/calendar/radicale-provisioner.js: zero-config auto-wiring - generates
  a 24-char password, writes Radicale htpasswd config (pure-Node APR1 hash
  verified byte-for-byte against openssl passwd -apr1 vectors), stores
  credentials, registers the source. Deploy hook in routes/apps/deploy.js
  wires any Radicale deployed via the App Selector automatically.
- Radicale app template (tomsquest/docker-radicale) in the catalog.
- Tests: 32 new (parser unit, provisioner unit incl. openssl vectors,
  route tests). Full suite 3552 passed; only pre-existing pdf-parse
  billing/invoice failures remain (proven red at base 448f535).
- OpenAPI: 5 calendar paths documented. CHANGELOG entry added.
 2026-10-07 19:57:22 -07:00