ArbeitszeitCheck - Releases

Added

• Auto break setting exposed to clients: the dashboard widget data (and the mobile home dashboard payload built on it) now includes autoBreakCalculation, the personal "automatic ArbZG §4 break insertion" setting, so client apps can explain whether the server may insert breaks automatically.

Added

• Mobile home dashboard endpoint: new GET /api/mobile/dashboard returns the full employee home payload (status, vacation entitlement/remaining, week hours, balance) for the proprietary employee mobile app, instead of the lean desklet summary.

Changed

• Time-tracking status endpoint usable from the mobile app: GET status no longer requires a CSRF token, matching the other read-only mobile endpoints (still requires an authenticated session or app password).

Changed

• Vendor public key baked into the app: AZC2 license verification now uses the production Ed25519 vendor public key by default. Customer servers no longer need AZC_VENDOR_PUBLIC_KEY_B64 for real licenses from SbdLicenseOps to verify. The env var remains an optional override (tests / experiments only).
• Clearer signature-mismatch warning: the admin license page no longer tells admins to configure AZC_VENDOR_PUBLIC_KEY_B64 as the primary fix.

Changed

• Kiosk admin UX overhaul: clearer three-step flow (find employee → allow access → assign badge/PIN), richer status labels, confirmations, and actionable error messages (including license/slot limits with a link to License administration).

Fixed

• Kiosk admin APIs required CSRF again: removed NoCSRFRequired from admin JSON endpoints so state-changing kiosk actions are protected like other admin APIs.
• Race conditions in kiosk pairing, enrollment, and PIN lockout: exclusive locks around terminal pairing, badge enrollment start/scan, and failed-PIN accounting so concurrent requests cannot double-consume license slots or skip lockout.
• Badge enrollment only on active terminals: enrollment now requires a paired (active) terminal instead of accepting pending/revoked ones.
• CSV credential import size limit: imports larger than 1 MB are rejected with a clear error instead of loading unbounded input.
• Sensitive kiosk responses are not cached: pairing codes and one-time PINs are returned with Cache-Control: no-store.

Added

• Instance-bound AZC2 licenses: license keys can now carry the Nextcloud instance ID and are rejected when applied on a different instance. The stored license state records the bound instance ID and a fingerprint of the applied key (migration 1033). The admin license page shows the instance ID to include when ordering a license.
• Daily license maintenance job: a new background job re-applies license limits once a day, so expired licenses or reduced seat/terminal quotas take effect overnight instead of only on the next admin interaction.
• Signature-verification warning in admin UI: if a stored license cannot be verified with the configured vendor public key, the admin page now shows a clear warning callout explaining the mismatch and how to fix it.

Changed

• Mobile license gate covers the whole mobile API: previously only clock/break POST endpoints returned HTTP 402 without a valid mobile license; now all /api/* mobile requests are gated (bootstrap, kiosk, and admin endpoints excluded), with an explicit LICENSE_REQUIRED error code for clients.
• Admin license page overhaul: redesigned layout with seat/terminal usage bars, assignment timestamps, and direct purchase/renewal contact actions.

Fixed

• Kiosk terminal pairing could leak device slots: creating or activating a terminal now reserves the licensed device slot transactionally — if pairing fails midway, the reserved slot is revoked instead of staying occupied.

Added

• Pre-migration backup before app updates: new BackupBeforeUpdate repair step runs automatically before schema migrations, plus occ arbeitszeitcheck:upgrade-backup for manual exports. Upgrade backups are catalogued with integrity checks and covered by unit/integration tests.

Fixed

• Manager "Record time for an employee" failed with "Status is required" (#27): shipped in this build (documented for 1.5.1 but missing from the published tarball). Manager-recorded inserts now set status and audit justification before validation runs.
• Data loss after disable during Nextcloud upgrade: UninstallRepairFlow now distinguishes disable from explicit removal — tables and settings are preserved on disable (including auto-disable during server upgrades); full cleanup runs only on app removal.

Fixed

• Update to 1.5.0 threw the whole instance into maintenance mode (#24): the 1.5.0 pro-rata feature added a 9th constructor dependency (VacationProrationService) to VacationAllocationService, but the published build's container factory in Application.php still passed only 8 arguments. During occ upgrade Nextcloud resolves repair steps through the container, which transitively builds VacationAllocationService, so the missing argument raised an ArgumentCountError and aborted the upgrade — leaving the server in maintenance mode until the app was disabled. The factory now passes all 9 dependencies.
• PHPUnit segfault in full unit suite (~test 583): DashboardDeskletRenderServiceTest instantiated legacy \OCP\Template after hundreds of prior tests, triggering PHP segfault from polluted globals. Template rendering moved to DashboardDeskletWorkspaceRenderer; the unit test mocks it, and a dedicated integration test covers real template output.

Changed

• Hardened the dependency-injection safety net so this class of upgrade crash cannot ship again. This was the second ArgumentCountError upgrade incident (after 1.4.2); the previous guard only validated the repair-step classes literally listed in info.xml, so a transitive dependency like VacationAllocationService slipped through. The release gate (scripts/check-repair-step-di.php) had an additional latent bug — a namespace path-resolution error meant its argument-count check silently never ran. The gate has been rewritten to:
• correctly resolve every app class to its source file, and
• validate the constructor arity of every service registered in Application.php (not just repair steps), using the PHP tokenizer so multi-line factories and promoted constructor properties are handled exactly.
• Two new automated guards back it up: ServiceContainerDiRegistrationTest (static, reflection-based, every registered service) and ContainerServiceResolutionIntegrationTest, which resolves all registered services through the real Nextcloud container — the exact path that fails during an upgrade.

Added

• Pro-rata vacation for partial employment years (#23): employees who join or leave mid-year now have their annual vacation entitlement reduced to the part of the year actually worked, instead of always receiving the full year's days.
• New optional employment start date (Eintrittsdatum) and employment end date (Austrittsdatum) per employee under Employees → Edit. Both empty means no proration (full entitlement, unchanged historic behaviour).
• New global admin setting Pro-rata vacation → Proration method: Full months (Zwölftelung, German default) — 1/12 per calendar month touched by the employment, with a fraction of half a day or more rounded up (BUrlG §5); or Exact days — annual entitlement × covered days ÷ days in year.
• The admin entitlement preview and the employee-facing "How is my vacation entitlement computed?" explainer both show the reduced figure with a clear note, so the displayed number always matches the usable balance.
• Proration is recorded in the entitlement trace and historical snapshots for audit purposes.

Fixed

• Broken app upgrade (1.3.x → 1.4.x): EnsureArbeitszeitCheckSchema was registered in Application.php with only IDBConnection while the repair step also requires IConfig, causing ArgumentCountError during occ upgrade / web updater and leaving the app stuck on “needs upgrade” with missing navigation routes. All repair steps from info.xml are now explicitly registered in the container; RepairStepDiRegistrationTest and extended UpgradeRepairIntegrationTest guard against recurrence.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable (pass 1); full cleanup runs only on app removal (pass 2). Fixes auto-disable during server upgrades wiping data when the app is re-enabled.

Fixed

• Dashboard widget: DashboardDeskletRenderService now uses \OCP\Template instead of the non-existent OCP\ITemplateManager, fixing Could not load lazy dashboard widget: EmployeeStatusWidget on the Nextcloud home dashboard.
• Callout partial: alert-callout.php defaults $calloutHint to an empty string so includes without a hint no longer emit PHP notices on the main app pages.

Fixed

• Install and upgrade path hardened. appinfo/info.xml now declares MySQL/PostgreSQL under <dependencies> (required by MigrationService for correct schema checks). EnsureArbeitszeitCheckSchema runs on install and before every post-migration repair chain so missing tables are recreated and failures surface in occ upgrade logs instead of a half-updated app with no UI feedback. Schema checks use the active table set only (legacy at_absence_calendar was dropped in migration 1012 and must not block upgrades). Repair steps use OC\DB\Connection for MigrationService, matching core occ upgrade.
• Post-migration repair DI. ReleaseStuckPendingAbsences is registered in Application.php with AbsenceService (same as BackfillAbsenceDays + HolidayService) so occ upgrade never instantiates repair steps with wrong constructor arguments after partial deploys.
• Admin schema banner. All admin pages show a critical callout when tables are missing, with pluralized guidance to run occ upgrade and deploy the full app bundle.
• Onboarding API no longer fakes success when the database is incomplete — returns SCHEMA_NOT_READY (503) with a clear message instead of “will be saved after database migration”.
• Health endpoint reports incomplete schema (missing table count) before the generic connection check.

Added

• SchemaHealth, EnsureArbeitszeitCheckSchemaTest, and extended UpgradeRepairIntegrationTest for the production upgrade container path.

Added

• Organisation-wide time recording methods (#16): Administrators can disable clock in/out (stamping) and/or manual time entries for everyone under Admin → Global settings → Time recording methods. Per-employee restrictions remain under Admin → Employees → Edit → Time recording. Organisation rules are enforced on every API path (clock, manual entries, dashboard, mobile bootstrap, desklet). Missing clock-in reminders are suppressed when stamping is off. Audit log shows a dedicated label for organisation changes; integration and E2E tests cover org-vs-employee layering and API enforcement.

Fixed

• Nextcloud Administration settings panel: organisation time capture checkboxes now load persisted values (previously always showed both methods enabled).
• Employee time capture validation: disabling both methods is rejected before persistence (HTTP 400, not 500).
• Admin settings status badge: uses shared WCAG-AA .azc-badge variants instead of low-contrast solid fills.

Unreleased

Fixed

• Callouts and notification icons (all Nextcloud themes): unified templates/common/alert-callout.php and css/common/notification-surfaces.css with theme-safe panel tints and semantic icon wells (same contrast model as the page header). Replaced invisible Lucide h.01 SVG marks in IconCatalog with visible accent dots; added IconCatalog::renderCalloutWell() and variant classes (azc-notif-icon-well--warning, etc.) so warning/danger/info glyphs stay identifiable on light, dark, high-contrast, and custom themes. Admin notifications save feedback uses matching callout styling and role="alert" on errors.

• Admin → Teams: member/manager picker now finds people by name (#14): the people picker searched the directory by user id only (IUserManager::search()), so on instances where the user id is an email, employee number or UUID, typing a person's name returned nothing — most of the directory was effectively hidden. All admin/manager people search now matches user id OR display name (shared UserDirectorySearch helper) across Teams, the Employees list, the company-status dashboard, the manager month-PDF picker and the scoped-employee picker. The Teams picker additionally excludes already-assigned members/managers server-side (exclude[]) so a large unit can no longer fill the capped result page with people already on the team, and shows a clear "Showing the first N matches — keep typing to narrow it down" hint (announced to screen readers) when more matches exist.

• Admin → Employees and time-entry tables: inflexible width / clipped actions (#12): table-heavy pages now use the wide shell (time-entries, absences, manager lists, compliance lists); .table-container scrolls horizontally only when columns need more space; action columns use min-width: max-content so Edit/History buttons stay fully visible on desktop; mobile keeps card reflow (azc-table--responsive + data-label). Manager scope pages no longer cap list width at 56rem. Playwright regression: tests/e2e/table-width-desktop.spec.js.
• Admin → Holidays: auto-restore now respected when deleting statutory holidays (#17): deleting a statutory holiday while Auto-restore is disabled records a per-(state, date) suppression (at_holiday_suppress) so the day stays removed in both the admin list and the calendar after a reload; re-enabling auto-restore revives the day and clears the stale suppression. The admin list and the working-day calendar now read from the same DB-backed source, so they can no longer diverge.
• Admin → Holidays: "Default federal state" select is now functional: the control on the Holidays page was rendered but never wired up — choosing a state did nothing. It now persists the organisation default state immediately (with disabled/aria-busy state, success/error feedback, and rollback on failure) via the existing admin settings API.
• Admin → Holidays: statutory holidays are forced to full-day: saving a statutory holiday now always stores kind=full (the working-day engine already treats statutory days as full-day), so the table badge can no longer claim "half-day" for a day that is counted as full.
• Admin → Holidays: honest delete feedback: removing a statutory holiday while auto-restore is enabled now states the day will be added back automatically, instead of a misleading "Holiday was removed" message.
• Sachsen-Anhalt statutory holidays (#13): GermanStatutoryHolidayCatalog seeds Epiphany (6 Jan) and Reformation Day for ST while excluding Corpus Christi and All Saints; auto-restore prunes legacy generated rows that used nationwide rules. occ arbeitszeitcheck:holidays:verify now reads the DB without reconciling first and fails when extra statutory rows remain (not only when catalog dates are missing).
• Admin → Employees: entitlement preview UX: human-readable summary line for HR; full calculationTrace JSON only inside a collapsible Technical details (audit) block (WCAG-friendly, no raw dump in the main form).

• Unified date format for Stichtag: overtime tracking start date uses the same dd.mm.yyyy datepicker as assignment validity dates (admin edit dialog and Nextcloud “New account” panel); values are converted to ISO before save.

• Admin → Employees: overtime Stichtag / opening balance not saved: UserOvertimeSettingsService passed the Nextcloud user id (string) as the audit log entityId (must be ?int), causing a TypeError on every Stichtag or Eröffnungssaldo write — with the atomic profile save this rolled back the whole transaction and surfaced as “Benutzer konnte nicht aktualisiert werden”. Audit entries now use null entity id (same pattern as time-capture settings).

• Admin user pickers (Teams, month reopen, overtime audit, vacation simulator): replaced the old 50-user dropdown cap with a searchable combobox (GET /api/admin/users?picker=1), minimum 2-character search, enabled accounts only, and shared WCAG-friendly styling. Legacy GET /api/admin/vacation-layers/users delegates to the same picker API.
• Admin → Employees list: browse all accounts with Previous / Next pagination (50 per page) and honest search feedback; empty search no longer hides employees beyond the first page.
• Manager employee filters (time entries, absences, record-absence form): replaced large <select> lists with the shared searchable combobox scoped to the manager’s team (GET /api/manager/scoped-employees); admins search the directory, managers only see their team.
• Admin company-status dashboard widget: status totals now scan up to 500 enabled accounts (was 200) and note when the directory is larger, with a link hint to Employees for the full list.
• Admin → Employees: server validation errors from the atomic profile save are now mapped to the matching form fields (instead of only a generic toast), with focus moved to the first invalid control.

Changed

• Admin → Employees: clearer “Find an employee” search with help text; pagination status shows ranges (1–50 of 150) or match counts when searching.
• Admin → Employees (edit dialog load): vacation policy for future-dated work-schedule assignments is resolved as of the assignment start date, not only “today”, so opening and saving no longer mis-defaults to “inherit” and triggers a failed save.

Fixed

• Calendar day details panel (#11): side drawer sits below the Nextcloud header (close control no longer hidden under the profile menu); calendar and app navigation stay visible while the panel is open; switch days without closing; close via X, Escape, or click outside; live header offset via syncAzcOverlayMetrics(); Vitest coverage in js/calendar-day-panel.test.js.

Changed

• Overlay tokens (--azc-overlay-top / --azc-overlay-height) shared for fixed panels and mobile nav; theme-safe dashboard callouts (WCAG 2.1 AA contrast on all Nextcloud themes).

Added

• Unified layout system: css/common/page-patterns.css with .azc-page-stack, .azc-shell--wide / --minimal, shared filter grid, empty/loading states; shellWidth on page shell (auto-wide for dashboards, admin tables, manager lists).
• Shared filter panel partials (templates/common/azc-filter-panel.php) and admin app teams callouts when use_app_teams is off.
• Dialog API: ArbeitszeitCheckComponents.openDialog(); modals use inert on nav/main instead of aria-hidden on #app-content (live regions stay available).
• AzcApi.isApiSuccess() for consistent JSON success checks.
• E2E: tests/e2e/layout-smoke.spec.js, tests/e2e/a11y-smoke.spec.js (@axe-core/playwright, WCAG 2.1 AA tags).

Changed

• All routed pages wrapped in .azc-page-stack; legacy .section chrome reset inside the app shell; .btn aliases to .azc-btn styling under #app-content.azc-app.
• Admin teams page uses full page shell (buildAdminShellParams); navigation exposes a single skip link to app nav (main content skip remains in page-start).
• Personal settings (Nextcloud user settings) and SettingsController load assets via FrontEndAssetService::registerCore() only.
• tests/WORKFLOW_ROLE_MATRIX.md: manager role requires app teams; /reports is manager/admin only.

Fixed

• Admin users page: pagination label uses {shown} / {total} placeholders and TemplateL10n for JS export — fixes Internal Server Error from json_encode($l->t('Showing %d of %d employees')) without vsprintf arguments.
• Employee absence request form: azc-card layout, visible page title, workflow callouts (auto-approve vs manager/substitute path), fieldsets for request details and substitute (fixes duplicate “Substitute” label), side-by-side dates, clearer optional/required labels, azc-btn actions.
• Time entry create/edit form: page shell + assets via TimeEntryController; timezone and approval callouts; azc-card with fieldsets (date/time, breaks, note); aligned break matrix labels; dynamic breaks match PHP a11y; responsive fieldset layout (WCAG 2.1 AA).
• Absence create/edit/view routes: AbsenceController now uses PageShellTrait + form assets (same gap as time-entry create had — broken nav/header without shell); errors render on the list page with a visible callout instead of a blank layout.
• Time entry edit errors: denied or failed edits show the list layout with shell, assets, and an error callout (no half-rendered page).
• Navigation flags: centralized in NavigationFlagsService + NavigationFlagsTrait (all page controllers including Manager, Substitute, Compliance) — removes duplicated getNavigationFlags() implementations; compliance pages use forComplianceUser() (substitution nav hidden).
• Absences list filter: legacy .section filter replaced with azc-card / azc-filter-grid (matches time entries list UX).
• API compliance gate: blockingIssuesForCompletedEntry() + pre-save check in apiStore / update / store — ArbZG §4 break rules always block invalid manual entries server-side (strict mode adds further checks without writing violations before persist).
• Calendar absence indicators: month/week cells show readable chips (type label + approval status + tinted icon), not icon-only strokes; week view shows absences; day panel lists status; legend explains approved vs pending; forced-colors and theme-safe contrast.
• Manager month-closure PDF page: refactored to azc-card step wizard (numbered steps, person rows with azc-btn downloads, standard-width shell); removed narrow floating column layout.
• Manager absences & time entries: legacy .section / .btn layout replaced with azc-page-stack, azc-card filter/results blocks, shared azc-filter-grid, standard-width centered shell (like month-closures), and azc-empty-state / azc-btn patterns.
• Manager dashboard: migrated from legacy .section blocks (broken by shell section reset) to azc-card sections, admin-style stat tiles, standard-width centered layout, and azc-btn export action.
• Admin holidays: refactored to azc-card layout, shared azc-filter-grid toolbar, table-container / table--hover, scoped CSS under azc-app--admin-holidays, and azc-btn row actions (fixes broken .admin-holidays-page selectors).
• Admin vacation layers: azc-page-stack + azc-card sections (intro, L0/L1/L2, simulator), table-container / table--hover, scoped layout under azc-app--admin-vacation-layers (removes duplicate page padding and standalone .layer-card chrome), azc-btn / azc-badge throughout.
• Employee time entries (list): timezone callout, stats, month closure, filter panel, and entries table use azc-card / azc-callout / azc-filter-grid; toolbar buttons relocate to the page header; scoped layout under azc-app--time-entries (fixes double margins from legacy .section / .stats-grid).
• Dashboard overtime balance: negative and positive balances use main text on tinted pills instead of raw --color-error / --color-success, so large values stay readable in all Nextcloud themes (WCAG contrast).
• Unified data tables: page-patterns.css defines one table system under #app-content.azc-app (.table-container + .table.table--hover, action columns, empty/loading cells); all routed list templates and dynamic report/admin tables migrated off legacy table-responsive / bare grid-table; TableConventionTest guards the convention.
• Manager absences & time entries: filters moved into the list card as a flat toolbar directly above the table (no nested box or azc-filter-panel accent); dedicated filter grid alignment (no subgrid glitches); “Record approved absence” sits below the list.
• Audit pass (workflows / a11y / security): l10n for app-teams callouts (en/de); admin teams full shell; working time model delete fail-closed typed DELETE; calendar day panel inert + focus trap + Escape; admin settings azc-callout errors; manager dashboard error path includes team-mode URLs.
• Breadcrumb trail: simplified shell markup (no separator <li> nodes) and scoped styles so the trail reads as one line — primary link, muted section, bold current page — with CSS / dividers and ellipsis on long titles.
• Compliance dashboard cards: migrated status and violations blocks to azc-card header/body layout (title + help left, actions right, sized button icons); removed broken card-header--with-actions stacking.
• Admin dashboard layout: fixed styles targeting wrong .admin-dashboard class (shell uses azc-app--admin-dashboard); removed extra .section padding; azc-callout warning banner; stat cards grid; issues block in azc-card.
• Confirm dialog typed phrase (client): if the translated label still contains %s after t() (e.g. test stubs or missing substitution), the requested phrase (DELETE, REMOVE, …) is applied so destructive prompts never show a raw placeholder.
• GDPR delete UX: when confirmDialog is unavailable, settings now surfaces an assertive error instead of failing silently; confirmation results use shared isConfirmAccepted / confirmDialogReason helpers.
• Fail-closed destructive confirms: Utils.confirmDestructiveAction() blocks month finalization, month reopen, correction withdraw, and overtime payout (single/bulk) when the dialog API is missing or the user cancels — no silent proceed (audit-critical). All admin delete paths (holidays, teams, vacation layers, tariff retire) now use the same helper.
• Month closure lock notice (W7): shared templates/common/month-closure-lock.php with lock icon; shown on time entries when the selected month is finalized.
• Settings UX: sections use azc-card spacing and azc-btn controls for clearer visual hierarchy (WCAG-friendly grouping unchanged).
• Substitution requests page: removed duplicate <h1> and orphan </div> (invalid HTML); styles now target .azc-app--substitution-requests so the shell layout applies; empty state uses azc-empty-state pattern.
• Dashboard clock double-submit (W11): setLoadingState() sets aria-busy="true" on clock/break buttons while API calls are in flight (with disabled state and loading label).
• Reports DATEV discoverability (W23): administrators see help text under file format pointing to Global settings → Exports and reporting (CSV/JSON remain on this page).
• Admin notifications (W13): sticky save footer, beforeunload when the form has unsaved changes, and aria-busy on save while the request is in flight.
• E2E vacation seed (ensure-e2e-vacation): UserVacationPolicyAssignment no longer pre-initialises vacation_mode, so INSERT always persists the column (fixes SQL 1364 on strict MariaDB).
• Clock status API (ArbZG calendar-day): at_daily_maximum and session_hours_on_calendar_today are now always returned (including when clocked out) so clients can block clock-in without an active session; overnight E2E asserts the contract when daily max is reached.
• E2E clock seed (ensure-e2e-clock): dev/CI-only OCC command for e2e_* users clears active sessions and backdates the last completed entry when ArbZG §5 rest would block Playwright clock-in; wired into run-e2e-docker.sh.

Added

• Vitest: js/common/components.test.js (focus trap / aria-hidden / typed-confirm label) and isConfirmAccepted coverage in utils.test.js.

Fixed

• Production-grade audit hardening pass (UX-parity follow-up):
• Manager dashboard (js/manager-dashboard.js): fixed an unbalanced paren on the team-overtime “Payout eligible: %s h” line that prevented the file from parsing, hiding the entire team status panel.
• Admin users (js/admin-users.js): the two opening-balance year validation messages were calling an undefined t() helper; they now use the page-local auMsg() so the German/English text is announced correctly via the messaging live region.
• Icon catalog (js/common/catalog.js): removed a duplicate calendar-off entry that produced silent overrides on load.
• Confirm dialog typed phrase (js/common/components.js): when callers passed a non-default typedConfirmPhrase (e.g. REMOVE), the label still said Type DELETE to confirm because the translation already substituted %s. The label is now resolved with the requested phrase so destructive prompts are honest.
• Stylesheets: replaced the deprecated clip: rect(...) screen-reader pattern with clip-path: inset(50%) in css/app.css and css/manager-time-entries.css; reordered border-color before border-left-color on .inline-notice--warning/--info so the longhand override actually wins; replaced two empty /* */ block comments that tripped stylelint.
• GDPR data deletion now persists the user-supplied reason: GdprController::delete() reads the reason parameter posted by the destructive confirm dialog (js/settings.js already sent it), trims/clamps it to 500 chars, and writes it into the gdpr_data_deletion_request audit log entry alongside the existing IP/user-agent stamp. Retention-period enforcement is unchanged.
• Tariff rule sets now produce a complete audit trail: AdminController::createTariffRuleSet/updateTariffRuleSet/activateTariffRuleSet/retireTariffRuleSet/deleteTariffRuleSet each write a structured tariff_rule_set_* entry with old/new snapshots (code, version, jurisdiction, status, activation mode, validity window, module list). Previously these admin mutations went through unnoticed.
• Admin authorization now returns JSON for API/AJAX callers: AppAdminMiddleware no longer serves an HTML 403 page when an unauthorized admin endpoint is hit via fetch/XHR or /api/... URLs. AJAX consumers now receive { ok: false, error: { code: 'admin_required' } } with HTTP 403, while browser page loads still get the standard core/403 template. Defensive guards keep the path safe under CLI/test runners. Covered by AppAdminMiddlewareTest (HTML, /api/ path, XMLHttpRequest header) and AppAdminAuthorizationIntegrationTest.

• Single source of truth for front-end assets: removed the duplicate CSS/JS list from Application::boot() — every page entry point now goes through FrontEndAssetService::register{Core,Page}(), including app-vanilla.css which is now imported by css/app.css. This eliminates load-order surprises and silent drift between the bootstrap loader and the central asset bundle.

• Night / overnight shifts (Wachdienst): ArbZG §3 daily maximum and automatic clock-out now use a single DailyWorkingHoursCalculator (calendar-day clipping at midnight). All enforcement paths aligned: live sessions, clock-in, compliance checks, manual entries, automatic breaks, break reminders. Fixes false auto clock-out shortly after midnight. Frontend auto clock-out only when at_daily_maximum is true (never client extrapolation alone). User stats and manager week/month totals now use getWorkingHoursForPeriod() (same calculator). Compliance “excessive working hours” violations now use findAllCalendarDaysExceedingMaximum() (no false positives on legal 22:00–08:00 rows). Audit reference: docs/DAILY-HOURS-AUDIT.md. E2E: tests/e2e/overnight-daily-maximum.spec.js.

Fixed

• New account + overtime tracking start date: the start date is captured reliably when clicking Create (no longer bound to the wrong dialog); the OCS hook runs only for POST …/cloud/users without sub-paths (LoadUsersSettingsArbeitszeitListener).
• Manager correction: data-entry-summary is emitted like PHP with JSON hex-encoding; display times (displayStartTime / displayBreaks); empty clock values show -- instead of misleading 00:00.
• Overtime: a future tracking start date no longer produces a fictitious negative balance in the current period.
• Opening balance year: server validates exactly four digits (2000–2100); client validates before save (OpeningBalanceYearValidator).

Fixed

• App enable / migration on Oracle-compatible Nextcloud installs where physical table names must stay within the 30-character limit (dbtableprefix + logical name). The overtime opening-balance table is now at_user_ot_year_bal (migration 1025), and migration 1026 renames the legacy at_user_overtime_year_balance table in place on instances that already created it, including PostgreSQL sequence cleanup. No data is copied or dropped except dropping an empty stray target table left by a failed prior attempt (same safety model as ProjectCheck table renames).

Added

• Manager employee time entries & absences — accessible filter bar (templates/manager-time-entries.php, manager-absences.php, css/manager-time-entries.css, js/manager-time-entries.js, js/manager-absences.js): two-row CSS grid with aligned labels/controls, WCAG 2.1 AA patterns (fieldset, aria-live errors, visually hidden sublabels), client-side date validation, and a 365-day maximum range enforced in the browser and on list APIs (ManagerController).
• Manager direct correction dialog on employee time entries (js/manager-correction-dialog.js, js/common/time-entry-clock-form.js, lib/Support/TimeEntryClockPayloadBuilder.php, shared correction l10n partial): European date + clock matrix, optional breaks, server-side payload builder with unit tests.
• TemplateL10n + templates/common/manager-employee-list-l10n.php: safe server-side JS translations (single json_encode of plain strings) — fixes Internal Server Error from json_encode($l->t('…%d…')) without vsprintf arguments on manager list pages.

Fixed

• Employee time entries page crash (ValueError in L10NString / vsprintf) when loading manager list l10n; %d strings are now translated with explicit parameters before JSON output.
• Compliance violations filter/export UX and admin dashboard overtime onboarding tweaks included in this release train.

Changed

• User manual (docs/User-Manual.en.md, docs/User-Manual.de.md) updated for manager list filters and correction workflow.

Fixed

• completePausedEntry() preserves an existing end_time on legacy paused rows that already carry a frozen end timestamp (status/end_time mismatch). Without this guard the service could overwrite payroll-relevant hours with updated_at.
• RepairOrphanedPausedEntries now sets ended_reason and policy_applied when it only flips paused → completed for rows that already have end_time, keeping upgrade-time repairs audit-consistent with steps 2–3.

Tests

• New: testCompletePausedEntryPreservesExistingEndTime.
• All 568 unit tests pass.

Added

• One-click recovery for "paused" time entries (issue: time-tracking/paused-entry-recovery, addresses upstream reports of "pausierte Einträge nicht bearbeitbar/abschließbar" and "HTTP 500 beim Ausstempeln, keine UI-Methode zum Heilen"). A new dedicated endpoint POST /api/time-entries/{id}/complete finalises an entry stuck in paused in a single, race-safe step. The end time defaults to updated_at (the moment the broken clock-out froze the row) and falls back to start_time as a zero-duration safety net; ArbZG §4 (automatic break) and ArbZG §3 (daily maximum) are applied so the resulting completed row is compliance-equivalent to a normal clock-out. Every recovery is audit-logged with time_entry_paused_completed, ownership is enforced, and the per-user mutation lock is honoured.
• "Complete session" affordance on the dashboard and time-entries list. When a session is in paused, the dashboard status card now shows a clearly-labelled "Complete session" button next to "Resume after break", and the time-entries list shows a primary "Complete" button per affected row plus a role="status" banner explaining the state in plain language. WCAG 2.1 AA: minimum 44×44 touch target, ARIA labels/titles, never colour-only signalling.
• TimeTrackingService::completePausedEntry() as the canonical programmatic recovery path. The controller is now a thin shell that parses input, delegates to the service, and maps domain exceptions (BusinessRuleException → 400/403, MonthFinalizedException → 409, LockedException → 423, DoesNotExistException → 404) — never a generic HTTP 500 for a known business state.
• TimeEntryMapper::findAllPausedByUser() + post-migration repair step RepairOrphanedPausedEntries that idempotently closes any leftover paused row on every occ upgrade: rows with an end_time are flipped to completed, rows without one are closed at updated_at (or start_time as a fallback).
• Layered vacation entitlement — degraded-state trace flags & impact preview (issue: hr/vacation-entitlement-hierarchy follow-up). The resolution trace now carries explicit degraded_org_default_collision (REQ-ENT-10), partial_history (REQ-ENT-13 / EC-11), clamped + raw_* values (EC-08), rule_set_status_warning (EC-05), and degraded='model_lookup_failed' (EC-04) markers so auditors can see misconfigurations and best-effort historical resolutions instead of silent fallback. The admin simulator surfaces these flags as labelled chips alongside the result; the employee explainer surfaces a redacted subset (degraded, clamped, partial_history) without leaking any internal IDs (REQ-SEC-05).
• Impact preview endpoint GET /api/admin/vacation-layers/impact?scope={org,model,team}&targetId={int} (REQ-UX-03). The vacation-layer dialog now shows "Up to N employees may be re-resolved by this change" inline before the admin clicks Save, with WCAG-compliant colour states that are never colour-only (icon + status text + ARIA live region).

Changed

• TimeTrackingController::buildSafeErrorResponse() now catches OCP\Lock\LockedException explicitly and returns HTTP 423 with a translatable "Another change to your time tracking is in progress" message, eliminating the opaque HTTP 500 reported on parallel clock-out / break-start.
• Paused / break / rejected status badges in the time-entries list now use semantic warning / error styling with descriptive title attributes so the state is conveyed via icon, colour, and text (WCAG 1.4.1).
• LayeredVacationConflictException for lock contention (REQ-SEC-04 / EC-07). LayeredVacationDefaultsService now wraps Nextcloud's OCP\Lock\LockedException so the AdminController returns HTTP 409 with a translatable "another administrator is editing this layer" hint instead of a generic 500. The admin JS surfaces the message in the dialog feedback area rather than dismissing the form.

Fixed

• Navigation icons script — remove duplicate navigation-icons.js IIFE that registered a second DOMContentLoaded handler; expose window.ArbeitszeitCheckNavigationIcons.apply for dynamic [data-lucide] placeholders after page load (CSP-safe local SVGs).

Tests

• New: 5 cases in TimeTrackingServiceTest covering the paused-entry recovery path.
• New: LayeredVacationEntitlementEngineTest, LayeredVacationDefaultsServiceTest, and AdminControllerTest cases for degraded-state flags, impact preview, and 409 lock mapping.
• All 567 unit tests pass.

Security

• CSRF protection on all state-changing endpoints: Removed #[NoCSRFRequired] from POST/PUT/DELETE methods in AbsenceController, TimeEntryController, TimeTrackingController, ComplianceController, SubstituteController, SettingsController, MonthClosureController, GdprController, and AdminController. The frontend already submits requesttoken consistently via ArbeitszeitCheckUtils.ajax, so all mutating routes now reject cross-site requests by default. GET-only endpoints intentionally remain #[NoCSRFRequired] (CSRF is irrelevant for read-only GETs in Nextcloud's framework).
• No raw exception leakage in JSON responses: Hardened AbsenceController::getSafeErrorMessage so that exception messages are only forwarded when they are explicit business-rule \Exception instances; messages containing technical fingerprints (SQL fragments, file paths, stack traces, oversized payloads) are replaced with a generic localized error. Applied the hardened helper to AbsenceController::store/update. Replaced direct getMessage() leakage in AdminController::getTeams, SettingsController::index_api, and PageController page-render error paths with sanitized localized messages.
• Correct HTTP status for authentication errors: SettingsController::update now returns HTTP 401 Unauthorized (was HTTP 400 Bad Request) when the request is unauthenticated, matching what API clients and load balancers expect.

Changed

• Organization-scope monthly report downloads: reports.js now forwards user IDs resolved during preview to the report.team endpoint and falls back to a clear "no organization members had time entries in the selected period" message instead of the misleading "preview first" hint when an organization-wide preview yields zero results.
• Sanitized dashboard load errors: dashboard.js/dashboard.css now surface a localized "Some dashboard data could not be loaded." live-region message instead of raw widget exceptions.
• Resume-after-break clarity: Clock-in copy and l10n unified around "Resume after break" instead of the legacy clock_in_resume placeholder.

Accessibility (WCAG 2.1 AA)

• Main landmark on every page: 17 page templates now expose a single, properly labelled <main id="app-content" role="main" aria-label="..."> landmark for assistive technologies (dashboard, index, timeline, calendar, settings, personal-settings, reports, compliance-dashboard, compliance-reports, compliance-violations, working-time-models, admin-dashboard, admin-teams, admin-users, admin-holidays, manager-dashboard, manager-time-entries, manager-absences, manager-month-closures).
• Skip link / <main> consistency: time-entries, absences, admin-settings, admin-notifications, substitution-requests, and audit-log previously had id="app-content" on a plain <div> while role="main" lived on a child wrapper, so the "Skip to main content" target landed on a non-landmark. All six now use <main id="app-content" role="main"> directly. Removed redundant role="banner" from the <header> inside audit-log's main region.
• Accessible names on all data tables: Added aria-label/aria-labelledby and screen-reader captions to the holiday list table and to the two notification-matrix tables that previously had no accessible name.
• Live error announcement on dashboard: Dashboard error section now lives inside an aria-live region so partial widget failures are announced without disrupting focus.
• Manager dashboard team metrics now announced: Stat numbers (Team Members / Active Today / Hours Today / Pending Absences) had aria-hidden="true" on the value spans, which silenced every metric for screen reader users. Each card now exposes a single, fully readable accessible name (e.g. "5 team members active today") via a role="group" wrapper while keeping the visual layout intact.
• Alert vs live-region conflicts resolved: Removed conflicting aria-live="polite" from role="alert" containers in absences.php (form error), admin-settings.php (global error banner), and three time-entry inline form errors. role="alert" already implies assertive announcements, so the previous polite override could delay critical validation feedback for assistive technology.
• Page heading hierarchy normalized: Every primary page template now exposes exactly one <h1> (dashboard, time-entries, absences, calendar, timeline, reports, settings, personal-settings, compliance-dashboard, compliance-reports, compliance-violations, working-time-models, admin-dashboard, admin-users, admin-holidays, admin-settings, admin-notifications, manager-dashboard). Previously most pages started at <h2>. Subordinate section headings in time-entries and absences were promoted to h2/h3 so the ladder no longer skips levels. CSS rules for .section-header h1 were added to inherit the existing h2 styling.
• Manager dashboard breadcrumb: Added the standard "Dashboard › Manager Dashboard" breadcrumb to align with all other primary pages and improve orientation for keyboard and screen reader users.
• Calendar loading state announced: The "Loading calendar…" placeholder now uses role="status" with aria-live="polite" so the loading and ready transitions are announced. The decorative spinner is aria-hidden.
• Focus indicators restored: outline: none was used on the timeline filter checkboxes and the admin user-picker items, breaking keyboard focus visibility. Added :focus-visible outlines using the primary color for both, preserving hover styling.
• Mobile touch targets: .btn--sm was 36 × 36 px on mobile, below WCAG 2.5.5's 44 × 44 advisory. The mobile media query now enforces 44 × 44 px on small buttons; desktop sizing is unchanged.
• Empty-state row for legacy index.php time-entries view: Restored the missing empty-state row when no entries exist (parity with the other table views in the same template).
• Reports access fallback navigation: Replaced an inline onclick redirect in reports.php's no-access empty state with a real <a> anchor so the dashboard fallback works without JavaScript and inherits standard link semantics.

Removed

• Stale Nextcloud personal-settings panel placeholder: The old personal-settings.php panel rendered inside Nextcloud's user-settings shell with hardcoded vacation-days / working-hours fields and reminder checkboxes that were never wired to any backend. Replaced it with a clean, accurate panel pointing the user to the in-app personal settings page (where these preferences are actually persisted via SettingsController::update) plus a short GDPR data-rights note. Kept the legacy index.php "settings" branch (dead code, but still in the file) but pulled the previously hardcoded 1.0.1 version string from IAppManager::getAppVersion('arbeitszeitcheck').

Tests

• AccessibilityTest hardened: Replaced the "must contain <button>" assertion (which permitted pages without keyboard-reachable controls and false-flagged link-only panels) with two stricter checks: (1) explicitly forbid the <div onclick=…> anti-pattern and (2) require at least one <button> or <a href> per audited template. Total suite: 455 tests, 1 652 assertions, all green.

Added

• Critical workflow audit checklist: Added tests/WORKFLOW_AUDIT_CHECKLIST.md as a concise release checklist for time tracking, manual entry corrections, absences/approvals, month closure, reporting/compliance/export behavior, and public error-surface expectations.

Changed

• Time tracking mutation safety: Clock/break mutations now use user-scoped locks and transactions; status polling remains read-only while automatic break fallback and daily maximum enforcement run through explicit mutation paths/background jobs.
• API input and error hardening: Report, export, compliance, manager, and time tracking endpoints now use stricter date/time parsing, safer validation responses, and generic public error messages for unexpected failures.
• Month-closure enforcement: Absence update/delete/cancel/shorten/approval/substitute flows now re-check month mutability before applying workflow mutations.

Fixed

• Health endpoint fingerprinting: The public health response no longer exposes app or Nextcloud version fields.

Added

• Absence approval forensics: Added approved_by_user_id persistence on absence records (approve/reject/auto-approve), with schema migration and API summary output.

Changed

• Vacation entitlement snapshot integrity: Added deterministic key-based upsert on (user_id, period_key, as_of_date) and migration-backed unique index enforcement.
• Concurrency control in critical workflows: Absence create/update/approve/reject/substitute flows now use user-scoped mutation locks plus transactional rechecks/row locks to prevent race-based overlap and over-approval inconsistencies.
• Release safety: Workflow/unit/integration tests were updated and executed against the hardened mutation paths.

Fixed

• Legacy snapshot repair path: Upsert now handles historical malformed rows and concurrent unique-key conflicts safely by retrying as deterministic update.
• Vacation balance write races: VacationYearBalanceMapper::upsert now resolves concurrent unique-key collisions via re-read/update fallback.

Changed

• Release packaging refresh: Bumped app metadata to 1.2.5 and regenerated the signed release artifact set for App Store and GitHub publication.

Changed

• Publishable release refresh: Bumped app metadata to 1.2.4 and generated a new signed release artifact set (archive, checksums, and App Store signature) for App Store/GitHub publication.

Changed

• Release packaging refresh: Prepared a new signed App Store/GitHub release archive for the current code line using the Docker-based signing workflow.

Fixed

• Localized decimal inputs in admin settings: Daily working-hour inputs now reliably accept comma-decimals like 7,74 and preserve two-decimal precision.
• Legacy hours API payload parsing: Time-entry endpoints now parse optional decimal hour fields consistently for both comma and dot separators, preventing silent truncation in backward-compatible request formats.

Changed

• Input precision hints: Updated settings input steps/help text to align with two-decimal hour values used in 38.7-hour week scenarios.

Fixed

• Paused-entry recovery and lifecycle: Paused entries can now be accessed again in edit/delete workflows and are consistently finalized as completed when edited with an end time.
• Resume behavior for same-day paused sessions: Clock-in now resumes a same-day paused entry instead of creating duplicate automatic entries, while preserving the pause gap as break history.
• Historical paused leftovers: Added migration Version1020Date20260421000000 to repair all remaining orphaned paused rows (including cases not covered by the earlier one-time migration).

Added

• Vacation entitlement policy engine: New policy-driven calculation flow with support for manual_fixed, model_based_simple, tariff_rule_based, and manual_exception, plus admin simulation endpoint.
• Tariff rule data model and APIs: Added versioned tariff rule sets/modules and admin endpoints to create, update, activate, retire, and assign policies to users.
• Entitlement computation snapshots: Added persistent entitlement snapshots (at_entitlement_snapshots) with calculation trace/policy fingerprint for auditability and diagnostics.
• Admin notifications page: New dedicated admin UI (/admin/notifications) with HR recipient + event matrix management and a dedicated notifications settings API.

Changed

• Vacation allocation integration: Year allocation now resolves entitlement via VacationEntitlementEngine and returns entitlement source/rule-set/trace metadata in allocation payloads.
• Policy migration compatibility: Existing user model vacation values are backfilled into policy assignments during migration (Version1018Date20260420123000) to keep legacy installs consistent.
• Admin settings flow: Absence notification-related controls (carryover expiry/cap, rollover switches, substitute-required types, iCal and substitution-mail toggles) are centralized on admin notifications APIs/UI.
• Working time model schema: Added work_days_per_week to at_models (Version1019Date20260420150000) to support entitlement formulas.

Fixed

• User deletion cleanup: Deleting a user now also removes vacation policy assignments and entitlement snapshots, preventing orphaned policy/computation data.

Fixed

• Approver deadlock (app teams): Absence and time-entry correction workflows no longer treat “has colleagues” as “has a manager”. Auto-approval when no assignable approver exists now follows TeamResolverService::hasAssignableManagerForEmployee() (explicit team managers in app-teams mode; legacy group mode still uses colleagues as a proxy). Prevents requests stuck in “awaiting manager approval” when nobody can approve.
• Time entry corrections: Same assignability rule as absences (previously used colleague IDs only).
• Admin users API requests on /index.php instances: Refresh/edit/history/update actions now reliably resolve app URLs and no longer produce invalid requests like search=[object PointerEvent].
• Admin teams and settings API reliability on rewrite-less setups: Central URL resolution now includes a robust /index.php fallback when OC.generateUrl() is unavailable/incomplete in page context.

Added

• Repair step ReleaseStuckPendingAbsences: post-migration repair auto-approves legacy pending absences that still match the “no assignable approver” condition (idempotent).
• Frontend URL security guardrails: Shared AJAX layer now blocks external cross-origin calls by default (explicit allowExternal: true required), with unit tests covering URL normalization and external URL handling.
• Lint guardrails: ESLint rules now prevent introducing raw fetch('/apps/arbeitszeitcheck/...') and implicit external fetch(...) patterns outside approved abstractions.

Changed

• UX: Absences UI shows an informational callout when app teams are enabled and no approver is assigned; detail view shows a defensive warning if an old pending row is still stuck (until repair/admin fixes team setup).
• Frontend architecture: ArbeitszeitCheckUtils now provides centralized getRequestToken(), resolveUrl(), and isExternalUrl() primitives used by page scripts (admin-users, reports, settings, validation).
• Mobile UX consistency (WCAG 2.1 AA focused): iPhone-safe-area-aware spacing, improved touch targets, clearer section rhythm, and better visual hierarchy for normal user pages (dashboard, time-entries, absences) and manager pages (manager-dashboard, manager-time-entries, employee absences view).

Documentation

• User manuals (EN/DE), tests/WORKFLOW_ROLE_MATRIX.md, and developer documentation updated for assignable-manager semantics and repair step.
• README and developer documentation updated with centralized frontend URL policy, strict external-call behavior, and mobile/iOS layout guidance.

Added

• Month closure grace period and auto-finalization: Admin setting month_closure_grace_days_after_eom (0–90, default 0). After end-of-month, employees have that many calendar days to finalize manually; if the month is still open afterward, a daily background job finalizes it automatically (same snapshot as manual finalize). Pending time entry approvals and open absence workflow states block auto-finalization. Reopening remains admin-only.
• App-admin allowlist: New admin setting app_admin_user_ids to restrict ArbeitszeitCheck administration to a selected subset of Nextcloud admins. Empty selection keeps backward-compatible behavior (all Nextcloud admins can administer the app).
• Security role-gating Docker test target: Added scripts/test-security-role-gating-docker.sh wiring via make test-security-role-gating-docker and composer test:security-role-gating:docker for fast authorization regression checks in containerized setups.

Changed

• Month closure UX and API: Employee UI uses a clearer card layout, visible feedback for success/errors (WCAG-friendly), server-driven canFinalize with localized block reasons (feature off, future month, pending approvals). Manual finalize rejects future calendar months. Absence workflow (pending, substitute_pending, substitute_declined) is enforced alongside pending time entry corrections. Unauthorized API access returns 401 where appropriate. Admin settings: dedicated “Month closure” section; grace-days field stays editable with copy explaining it is saved even when closure is off; reopen uses searchable employee picker and clearer administrator vs. employee wording. Form validation error callouts use higher-contrast text and tinted surfaces across themes. Auto-finalize job logs per-user failures for operations.
• Release/signing workflow hardened for integrity checks: make release-signed now signs the extracted release archive payload (not the local development checkout), validates forbidden development paths are excluded, and repacks the signed archive for deployment/App Store upload.
• Admin authorization enforcement: Access to AdminController routes now uses middleware-level app-admin checks with a dedicated exception and a consistent 403 response page for authenticated users without app-admin rights.

Documentation

• Deployment guidance: Release docs now explicitly require production deployment from the signed tarball only and document the common integrity-failure pattern (.git/* / node_modules/* lists) caused by signing a dev tree.
• Deployment helper script: Added release/deploy-from-release.sh to deploy from signed release archives with safety checks (forbidden path scan, required signature.json, optional app disable/enable and occ integrity:check-app).
• Admin operations: User/developer docs now describe how to configure app-admin allowlisting, what the default fallback is, and how to verify authorization gating in Docker-based test runs.

Added

• Revision-safe month finalization (optional): Admin toggle month_closure_enabled (default off). Employees can finalize a full calendar month; the app stores a canonical JSON snapshot, SHA-256 hash chain, append-only revision rows, audit events, and a minimal PDF download. Finalized months are read-only through normal app APIs; administrators may reopen a month with a mandatory reason (audit). Monthly reports for a finalized month use the stored snapshot. Database: at_month_closure, at_month_closure_revision (migration Version1014Date20260409120000).

Documentation

• User manuals (EN/DE), developer documentation, and compliance notes updated for month closure, retention context, and limits (in-app tamper evidence, not QES).

Added

• Manager employee absences view: New in-app page and API for managers/admins to review employee absences with secure scope filtering, pagination, and localized status labels.
• Working time model copy flow: Added copy action with modal UX, unique default naming, and safeguards against duplicate submits.

Changed

• Manager navigation structure: Sidebar regrouped into clearer manager/admin submenus; reports moved under manager context; compliance link placement adjusted for reduced top-level clutter.
• Manager employee time entries UX: Date defaults and formatting/translation handling improved for clearer filtering behavior.
• Calendar behavior (rollback cleanup): Removed in-progress direct calendar-write functionality and related admin controls/status/test endpoints. The supported behavior remains unchanged: no Nextcloud Calendar app sync; optional .ics attachments are sent by email for configured absence workflows.

Fixed

• Working time model modals: Corrected copy modal interaction flow, source-model presentation, and delete-confirmation localization/rendering issues.
• Absence iCal hardening: Added stricter status/date guards, recipient deduplication, and privacy-safe event descriptions for substitute/manager recipients.

Documentation

• User manuals and changelogs updated to reflect the final calendar model (email .ics optional, no direct Nextcloud Calendar app sync) and current manager/admin UX structure.

Added

• Vacation rollover: VacationRolloverService, background job, occ arbeitszeitcheck:vacation-rollover, migration Version1013Date20260407120000 with at_vacation_rollover_log; unit tests.

Changed

• Frontend l10n: Shared templates/common/main-ui-l10n.php and teams-l10n.php so translated strings are available early across pages; related template and JS updates.

Fixed

• Manager dashboard — pending absences: API includes summary.typeLabel (server-localized absence type); UI prefers it so cards show translated labels (e.g. German Urlaub) instead of raw codes like vacation.

Documentation

• docs/Developer-Documentation.en.md: pending-approvals API note for typeLabel; user manuals (EN/DE): manager pending approvals show localized absence types.

Added

• Development tooling: occ arbeitszeitcheck:generate-test-data CLI for deterministic demo data (time entries, absences, optional violations, demo app team) to exercise UI, reports, and workflows locally.

Fixed

• Reports UI: Report type cards are no longer incorrectly disabled when a team-related scope is selected (team scopes still use the team report API where applicable).
• Reports (tests): Team report CSV download test now reads download bodies via DataDownloadResponse::render() (Nextcloud API).
• Team reports: Deduplicate user IDs before permission checks and aggregation to avoid double-counting when users appear in multiple teams.
• Absence type badges: Stronger, theme-safe contrast for vacation / sick / home office / other badges (readable on pale Nextcloud palettes).

Changed

• Compatibility (dev): Local development stacks aligned with Nextcloud 33.x (example: official nextcloud Docker image).
• Reports layout: Reverted an overly aggressive “full width” parameter form rule that could interfere with scrolling/layout on the reports page.

Fixed

• Admin settings API URL handling: Prevented duplicate index.php/index.php path generation when a route URL is already pre-generated by Nextcloud.
• Frontend error handling: Avoided unhandled Promise rejections in callback-based Utils.ajax() consumers after expected API failures.

Fixed

• Routing/compatibility: Added indexApi() compatibility aliases for legacy endpoints to prevent 500 errors in the Nextcloud log.
• PHP fatal errors: Fixed constructor signature issues in AbsenceService and ComplianceService that could crash the app when loading services or saving settings.
• Reports security hardening: Hardened report preview endpoints with start <= end validation and a maximum date-range limit to reduce DoS risk from untrusted parameters.
• Admin “whole organization” scope: Correctly handle admin organization scope (userId="" = all enabled users) and enforce access checks so preview/download data stays consistent.
• Reports rendering: Improved Preview rendering for absence and compliance reports to match the actual report data structure.

Changed

• Reports UI semantics: Team scope is limited to the team overview/export semantics that the backend actually returns (prevents misleading previews/downloads).
• Organization download guidance: Added explicit UI messaging for organization scope download limitations until organization-wide export endpoints are implemented.

Fixed

• ArbZG compliance: Corrected break check logic (9h/45min branch now reachable; check ≥9h before ≥6h)
• Manager logic: employeeHasManager() now uses getManagerIdsForEmployee() instead of getColleagueIds()
• Reporting: getTeamHoursSummary() respects period parameter (week/month)
• Admin users: hasTimeEntriesToday is now per-user, not system-wide
• UserSettingsMapper: Fixed falsy zero/empty-string handling in getIntegerSetting, getFloatSetting, getStringSetting
• Routing: Moved exportUsers route above getUser to fix route shadowing
• Version1009 migration: Replaced MySQL backtick SQL with portable QueryBuilder; use OCP\DB\Types
• Duplicate notifier: Removed double registration from Application.php boot()
• API security: Generic error messages instead of raw exception output (SubstituteController, GdprController)
• PDF export: Returns HTTP 422 with clear message instead of silent CSV fallback
• LIKE injection: WorkingTimeModelMapper::searchByName() uses escapeLikeParameter()
• XSS: Modal titles escaped in components.js; compliance-violations.js innerHTML escaped
• Admin-settings form: Added CSRF requesttoken
• AbsenceService DI: Fixed constructor argument order (IDBConnection)
• Admin holidays and settings: English source strings for l10n keys
• UserDeletedListener: inject TeamMemberMapper and TeamManagerMapper
• XSS: sanitise team names in admin-teams.js

Changed

• CSS: Shadow-light variable, scoped resets, dark-mode color-mix fixes, semantic color variables, navigation height/z-index
• Clock buttons: Double-submit guard (disabled during API calls)
• initTimeline(): Max retry count (20) to prevent infinite loop
• Accessibility: aria-label on header buttons, label for admin user search, aria-modal on welcome dialog, English l10n keys in navigation
• Docs: Removed internal docs; added docs/README; corrected repo URLs
• Manager dashboard: Injected l10n from PHP so JS translations work
• Constants.php for magic numbers; user-facing error messages

Added

• Version1010 migration: Compound indices on at_entries, at_violations, at_holidays, at_absences

Changed

• Long-term refactor: Replaced all \OC::$server usage with proper OCP APIs and constructor injection
• CSPService: Injected ContentSecurityPolicyNonceManager via constructor
• Controllers: Removed manual cspNonce (configureCSP handles it); injected IURLGenerator, IConfig where needed
• PageController: Injected IURLGenerator, IConfig; passes urlGenerator to templates
• HealthController: Injected IDBConnection for database check
• ProjectCheckIntegrationService: Injected LoggerInterface instead of OC::$server->getLogger()
• Templates: Replaced \OC::$server with \OCP\Server::get() (OCP public API)
• Added GitHub Actions release workflow (.github/workflows/release.yml)
• Updated PageControllerTest with full constructor mocks

Fixed

• Resolved duplicate route names in absence API (absence#store, absence#show, absence#update, absence#delete)
• Corrected settings class names in info.xml to use full OCA namespace
• Added declare(strict_types=1) to routes.php

Changed

• Removed non-existent screenshot references from info.xml until real screenshots are captured

Added

• Auto break setting exposed to clients: the dashboard widget data (and the mobile home dashboard payload built on it) now includes autoBreakCalculation, the personal "automatic ArbZG §4 break insertion" setting, so client apps can explain whether the server may insert breaks automatically.

Added

• Mobile home dashboard endpoint: new GET /api/mobile/dashboard returns the full employee home payload (status, vacation entitlement/remaining, week hours, balance) for the proprietary employee mobile app, instead of the lean desklet summary.

Changed

• Time-tracking status endpoint usable from the mobile app: GET status no longer requires a CSRF token, matching the other read-only mobile endpoints (still requires an authenticated session or app password).

Changed

• Vendor public key baked into the app: AZC2 license verification now uses the production Ed25519 vendor public key by default. Customer servers no longer need AZC_VENDOR_PUBLIC_KEY_B64 for real licenses from SbdLicenseOps to verify. The env var remains an optional override (tests / experiments only).
• Clearer signature-mismatch warning: the admin license page no longer tells admins to configure AZC_VENDOR_PUBLIC_KEY_B64 as the primary fix.

Changed

• Kiosk admin UX overhaul: clearer three-step flow (find employee → allow access → assign badge/PIN), richer status labels, confirmations, and actionable error messages (including license/slot limits with a link to License administration).

Fixed

• Kiosk admin APIs required CSRF again: removed NoCSRFRequired from admin JSON endpoints so state-changing kiosk actions are protected like other admin APIs.
• Race conditions in kiosk pairing, enrollment, and PIN lockout: exclusive locks around terminal pairing, badge enrollment start/scan, and failed-PIN accounting so concurrent requests cannot double-consume license slots or skip lockout.
• Badge enrollment only on active terminals: enrollment now requires a paired (active) terminal instead of accepting pending/revoked ones.
• CSV credential import size limit: imports larger than 1 MB are rejected with a clear error instead of loading unbounded input.
• Sensitive kiosk responses are not cached: pairing codes and one-time PINs are returned with Cache-Control: no-store.

Added

• Instance-bound AZC2 licenses: license keys can now carry the Nextcloud instance ID and are rejected when applied on a different instance. The stored license state records the bound instance ID and a fingerprint of the applied key (migration 1033). The admin license page shows the instance ID to include when ordering a license.
• Daily license maintenance job: a new background job re-applies license limits once a day, so expired licenses or reduced seat/terminal quotas take effect overnight instead of only on the next admin interaction.
• Signature-verification warning in admin UI: if a stored license cannot be verified with the configured vendor public key, the admin page now shows a clear warning callout explaining the mismatch and how to fix it.

Changed

• Mobile license gate covers the whole mobile API: previously only clock/break POST endpoints returned HTTP 402 without a valid mobile license; now all /api/* mobile requests are gated (bootstrap, kiosk, and admin endpoints excluded), with an explicit LICENSE_REQUIRED error code for clients.
• Admin license page overhaul: redesigned layout with seat/terminal usage bars, assignment timestamps, and direct purchase/renewal contact actions.

Fixed

• Kiosk terminal pairing could leak device slots: creating or activating a terminal now reserves the licensed device slot transactionally — if pairing fails midway, the reserved slot is revoked instead of staying occupied.

Added

• Pre-migration backup before app updates: new BackupBeforeUpdate repair step runs automatically before schema migrations, plus occ arbeitszeitcheck:upgrade-backup for manual exports. Upgrade backups are catalogued with integrity checks and covered by unit/integration tests.

Fixed

• Manager "Record time for an employee" failed with "Status is required" (#27): shipped in this build (documented for 1.5.1 but missing from the published tarball). Manager-recorded inserts now set status and audit justification before validation runs.
• Data loss after disable during Nextcloud upgrade: UninstallRepairFlow now distinguishes disable from explicit removal — tables and settings are preserved on disable (including auto-disable during server upgrades); full cleanup runs only on app removal.

Fixed

• Update to 1.5.0 threw the whole instance into maintenance mode (#24): the 1.5.0 pro-rata feature added a 9th constructor dependency (VacationProrationService) to VacationAllocationService, but the published build's container factory in Application.php still passed only 8 arguments. During occ upgrade Nextcloud resolves repair steps through the container, which transitively builds VacationAllocationService, so the missing argument raised an ArgumentCountError and aborted the upgrade — leaving the server in maintenance mode until the app was disabled. The factory now passes all 9 dependencies.
• PHPUnit segfault in full unit suite (~test 583): DashboardDeskletRenderServiceTest instantiated legacy \OCP\Template after hundreds of prior tests, triggering PHP segfault from polluted globals. Template rendering moved to DashboardDeskletWorkspaceRenderer; the unit test mocks it, and a dedicated integration test covers real template output.

Changed

• Hardened the dependency-injection safety net so this class of upgrade crash cannot ship again. This was the second ArgumentCountError upgrade incident (after 1.4.2); the previous guard only validated the repair-step classes literally listed in info.xml, so a transitive dependency like VacationAllocationService slipped through. The release gate (scripts/check-repair-step-di.php) had an additional latent bug — a namespace path-resolution error meant its argument-count check silently never ran. The gate has been rewritten to:
• correctly resolve every app class to its source file, and
• validate the constructor arity of every service registered in Application.php (not just repair steps), using the PHP tokenizer so multi-line factories and promoted constructor properties are handled exactly.
• Two new automated guards back it up: ServiceContainerDiRegistrationTest (static, reflection-based, every registered service) and ContainerServiceResolutionIntegrationTest, which resolves all registered services through the real Nextcloud container — the exact path that fails during an upgrade.

Added

• Pro-rata vacation for partial employment years (#23): employees who join or leave mid-year now have their annual vacation entitlement reduced to the part of the year actually worked, instead of always receiving the full year's days.
• New optional employment start date (Eintrittsdatum) and employment end date (Austrittsdatum) per employee under Employees → Edit. Both empty means no proration (full entitlement, unchanged historic behaviour).
• New global admin setting Pro-rata vacation → Proration method: Full months (Zwölftelung, German default) — 1/12 per calendar month touched by the employment, with a fraction of half a day or more rounded up (BUrlG §5); or Exact days — annual entitlement × covered days ÷ days in year.
• The admin entitlement preview and the employee-facing "How is my vacation entitlement computed?" explainer both show the reduced figure with a clear note, so the displayed number always matches the usable balance.
• Proration is recorded in the entitlement trace and historical snapshots for audit purposes.

Fixed

• Broken app upgrade (1.3.x → 1.4.x): EnsureArbeitszeitCheckSchema was registered in Application.php with only IDBConnection while the repair step also requires IConfig, causing ArgumentCountError during occ upgrade / web updater and leaving the app stuck on “needs upgrade” with missing navigation routes. All repair steps from info.xml are now explicitly registered in the container; RepairStepDiRegistrationTest and extended UpgradeRepairIntegrationTest guard against recurrence.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable (pass 1); full cleanup runs only on app removal (pass 2). Fixes auto-disable during server upgrades wiping data when the app is re-enabled.

Fixed

• Dashboard widget: DashboardDeskletRenderService now uses \OCP\Template instead of the non-existent OCP\ITemplateManager, fixing Could not load lazy dashboard widget: EmployeeStatusWidget on the Nextcloud home dashboard.
• Callout partial: alert-callout.php defaults $calloutHint to an empty string so includes without a hint no longer emit PHP notices on the main app pages.

Fixed

• Install and upgrade path hardened. appinfo/info.xml now declares MySQL/PostgreSQL under <dependencies> (required by MigrationService for correct schema checks). EnsureArbeitszeitCheckSchema runs on install and before every post-migration repair chain so missing tables are recreated and failures surface in occ upgrade logs instead of a half-updated app with no UI feedback. Schema checks use the active table set only (legacy at_absence_calendar was dropped in migration 1012 and must not block upgrades). Repair steps use OC\DB\Connection for MigrationService, matching core occ upgrade.
• Post-migration repair DI. ReleaseStuckPendingAbsences is registered in Application.php with AbsenceService (same as BackfillAbsenceDays + HolidayService) so occ upgrade never instantiates repair steps with wrong constructor arguments after partial deploys.
• Admin schema banner. All admin pages show a critical callout when tables are missing, with pluralized guidance to run occ upgrade and deploy the full app bundle.
• Onboarding API no longer fakes success when the database is incomplete — returns SCHEMA_NOT_READY (503) with a clear message instead of “will be saved after database migration”.
• Health endpoint reports incomplete schema (missing table count) before the generic connection check.