BudgetCheck - Releases

Changed

• shared app-feedback render (focus-ring + toast-dedup SSOT)
• Atlas farm v3.5.15: strict-id route reqs + contrast suite + l10n generator fix + test-harness cascade

Unreleased

Added

• CSV import: separate income and expense columns (issue #23): bank exports that split the amount into two columns — one value per row, the other left blank — now import without editing the file. Recognised headers include “Expenses”/“Income”, “Ausgaben”/“Einnahmen”, and “Debit”/“Credit” or “Soll”/“Haben” pairs when they contain amounts; a minus sign on the expense column is accepted, and a bare dash counts as empty. Ambiguous header names are decided by their data, so a single “Debit” column holding debit/credit keywords still works as a direction column. Extra columns such as a running balance are ignored.

Fixed

• API hardening: stricter request validation and error paths.
• Theme rendering now uses real OCS theming values; field-level error rendering synced from the shared component.
• Localization parity and catalog corpus fixes.

Changed

• Atlas v3.5.14 verification pass: expanded contract coverage; store screenshot URLs corrected.

Fixed

• Attachment View/Download 404 with doubled /index.php/ (#20): on installs without pretty URLs, linkToRoute already returns /index.php/apps/budgetcheck/.... The gallery was calling OC.generateUrl again and producing /index.php/index.php/.... Delete was unaffected (relative API paths). Companion app uses the mobile download API and was not affected.
• l10n parity: dropped orphan msgids with a literal \' (PHP-escape leak of “Copy last month's budget…”) from fr/nl/it/pl/pt_BR, reordered catalogs to match en.json, and hardened check-l10n-parity.php + sync-l10n-keys-from-en.php so this class of drift fails CI and is one command to repair.

Added

• Delete workspace (#19): managers can permanently remove a workspace from Settings → Workspace (typed-name confirmation, impact preview, cascade of bookings/attachments/budgets/members/snapshots). Project workspaces warn that InvoiceCheck invoices remain but settlement links break.
• Mobile companion API 7: DELETE /api/mobile/v1/workspaces/{id} with the same confirmName gate and rate limit (5/hour).

Security

• Workspace delete is manager-only (private workspaces: individual manager only; no app-admin bypass). Exact workspace-name confirmation required.

Added

• Recurring posting modes (#18): each rule chooses how dues land on the ledger.
• Book automatically (default for new rules): writes real transactions on Generate / when due.
• Plan for bank import (legacy behaviour, kept for existing rules): writes planned reminders that a matching import removes.
• Hourly RecurringDueJob: auto-books active book-mode rules when next_due_date is on or before today in the workspace timezone. Plan-mode rules stay manual.
• Catch-up actions: per-rule “Book now / Add plan now” for overdue dues, plus workspace “Add everything due”.
• Generate can promote an existing planned twin to a real booking when switching to book mode (idempotent per rule+date).

Changed

• Recurring settings UX rewritten for clarity (two modes, due badges, simpler verbs). WCAG 2.1 AA focus/labels retained.
• Contributors see Settings → Recurring for catch-up only (Book / Add plan / Add everything due); create/edit/delete stay managers-only. Viewers stay redirected.
• Inactive rules no longer offer Book/Add plan (plain “Paused” hint); Due badges expose an accessible name.
• Real ledger rows may keep recurring_rule_id for provenance; uniqueness is one live row per (rule, date).
• Closed months are skipped during generate/auto-due so the cursor never stalls forever.
• Mobile recurring suggestions read amount.minor from the hydrated envelope (fixes always-zero amounts).
• Full BudgetCheck native-speaker quality pass (web + companion): register (Sie/vous/usted/u/Lei), Transactions nav binding, workspace-manager role terms, untranslated lock/offline mobile strings, glossary alignment (PL Księgowania; IT button chrome vs Lei body).

Fixed

• Book + import no longer doubles: matching bank/manual bookings (no recurring_rule_id) soft-delete the live book-mode auto-book. Recurring generate itself never replaces sibling months (adjacent-month matcher is import-only).
• Dev cron sidecar: nextcloud-cron service + backgroundjobs_mode=cron so RecurringDueJob runs without web traffic. List recurring also does a rate-limited opportunistic due sweep.
• Mobile recurring UI: Start → “Add what is due” screen with Book now (wired to generate-due API).

Security

• Auto-due uses the rule author (fallback: earliest workspace manager) under the same contributor ACL as manual Generate; FOR UPDATE on the rule prevents double-posts under concurrent job + UI.
• Add full period (mode=full_period / future through) is managers-only at API and service layer; contributors retain due catch-up Generate (dueCatchUp + through ≤ today).

Changed

• shared app-feedback render (focus-ring + toast-dedup SSOT)
• Atlas farm v3.5.15: strict-id route reqs + contrast suite + l10n generator fix + test-harness cascade

Unreleased

Added

• CSV import: separate income and expense columns (issue #23): bank exports that split the amount into two columns — one value per row, the other left blank — now import without editing the file. Recognised headers include “Expenses”/“Income”, “Ausgaben”/“Einnahmen”, and “Debit”/“Credit” or “Soll”/“Haben” pairs when they contain amounts; a minus sign on the expense column is accepted, and a bare dash counts as empty. Ambiguous header names are decided by their data, so a single “Debit” column holding debit/credit keywords still works as a direction column. Extra columns such as a running balance are ignored.

Fixed

• API hardening: stricter request validation and error paths.
• Theme rendering now uses real OCS theming values; field-level error rendering synced from the shared component.
• Localization parity and catalog corpus fixes.

Changed

• Atlas v3.5.14 verification pass: expanded contract coverage; store screenshot URLs corrected.

Fixed

• Attachment View/Download 404 with doubled /index.php/ (#20): on installs without pretty URLs, linkToRoute already returns /index.php/apps/budgetcheck/.... The gallery was calling OC.generateUrl again and producing /index.php/index.php/.... Delete was unaffected (relative API paths). Companion app uses the mobile download API and was not affected.
• l10n parity: dropped orphan msgids with a literal \' (PHP-escape leak of “Copy last month's budget…”) from fr/nl/it/pl/pt_BR, reordered catalogs to match en.json, and hardened check-l10n-parity.php + sync-l10n-keys-from-en.php so this class of drift fails CI and is one command to repair.

Added

• Delete workspace (#19): managers can permanently remove a workspace from Settings → Workspace (typed-name confirmation, impact preview, cascade of bookings/attachments/budgets/members/snapshots). Project workspaces warn that InvoiceCheck invoices remain but settlement links break.
• Mobile companion API 7: DELETE /api/mobile/v1/workspaces/{id} with the same confirmName gate and rate limit (5/hour).

Security

• Workspace delete is manager-only (private workspaces: individual manager only; no app-admin bypass). Exact workspace-name confirmation required.

Added

• Recurring posting modes (#18): each rule chooses how dues land on the ledger.
• Book automatically (default for new rules): writes real transactions on Generate / when due.
• Plan for bank import (legacy behaviour, kept for existing rules): writes planned reminders that a matching import removes.
• Hourly RecurringDueJob: auto-books active book-mode rules when next_due_date is on or before today in the workspace timezone. Plan-mode rules stay manual.
• Catch-up actions: per-rule “Book now / Add plan now” for overdue dues, plus workspace “Add everything due”.
• Generate can promote an existing planned twin to a real booking when switching to book mode (idempotent per rule+date).

Changed

• Recurring settings UX rewritten for clarity (two modes, due badges, simpler verbs). WCAG 2.1 AA focus/labels retained.
• Contributors see Settings → Recurring for catch-up only (Book / Add plan / Add everything due); create/edit/delete stay managers-only. Viewers stay redirected.
• Inactive rules no longer offer Book/Add plan (plain “Paused” hint); Due badges expose an accessible name.
• Real ledger rows may keep recurring_rule_id for provenance; uniqueness is one live row per (rule, date).
• Closed months are skipped during generate/auto-due so the cursor never stalls forever.
• Mobile recurring suggestions read amount.minor from the hydrated envelope (fixes always-zero amounts).
• Full BudgetCheck native-speaker quality pass (web + companion): register (Sie/vous/usted/u/Lei), Transactions nav binding, workspace-manager role terms, untranslated lock/offline mobile strings, glossary alignment (PL Księgowania; IT button chrome vs Lei body).

Fixed

• Book + import no longer doubles: matching bank/manual bookings (no recurring_rule_id) soft-delete the live book-mode auto-book. Recurring generate itself never replaces sibling months (adjacent-month matcher is import-only).
• Dev cron sidecar: nextcloud-cron service + backgroundjobs_mode=cron so RecurringDueJob runs without web traffic. List recurring also does a rate-limited opportunistic due sweep.
• Mobile recurring UI: Start → “Add what is due” screen with Book now (wired to generate-due API).

Security

• Auto-due uses the rule author (fallback: earliest workspace manager) under the same contributor ACL as manual Generate; FOR UPDATE on the rule prevents double-posts under concurrent job + UI.
• Add full period (mode=full_period / future through) is managers-only at API and service layer; contributors retain due catch-up Generate (dueCatchUp + through ≤ today).

Fixed

• Rate limits for LDAP/AD UUID user ids (#17): counters are stored in per-user preferences (rate_limit:{action}) instead of embedding the userId in an oc_appconfig key (VARCHAR(64)). Favoriting workspaces and other rate-limited actions work for UUID-style UIDs; exclusive locking also respects the 64-char oc_file_locks key limit.

Changed

• l10n glossary alignment: corrected wrong translations and standardised button labels across all shipped locales to match the cross-app glossary.
• Help, Support & Us / Get the App: WCAG 2.1 AA hardening and translated footer copy for all website footer locales.
• CI: collapsed GitHub Actions to a single PHP syntax-only smoke job; full test suites stay local.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Added

• Brazilian Portuguese (pt_BR): full UI catalog (l10n/pt_BR.json / pt_BR.js).

Changed

• l10n tooling: parity / regenerate / sync scripts recognise pt_BR.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Changed

• Sole-manager private workspaces: converting standard → private no longer requires a second manager. Demoting/removing managers uses the normal last-manager rule (≥1). Groups are still forbidden on private workspaces.
• Confirmation and help copy warn that if the sole manager account is removed, the private workspace cannot be opened in BudgetCheck (host/DB recovery only).

Added

• Private workspaces (ACL confidential mode): managers can mark a workspace private so Nextcloud system admins and BudgetCheck app admins who are not members cannot see it in lists or open workspace-scoped APIs. Host/DB disclosure is shown before enabling private (not E2EE).
• Create rules: any user who can open the app may create a private workspace; standard workspace create remains app-admin-only.
• Companion API 6: mobile clients can create with privacyMode and update privacy via PUT /api/mobile/v1/workspaces/{id} under the same dual-manager / no-groups guards.
• Web and companion UX for privacy mode (settings fieldset, create modal, members group lock, Private badge).

Changed

• Converting a standard workspace to private requires ≥2 individual managers and no Nextcloud group memberships; private workspaces allow individuals only.
• Member demote/remove and privacy toggles serialize with workspace row locks to avoid last-manager races.
• Favorites / last-used and admin digest surfaces clip or opaque-count private workspaces (no name/id leak to non-members).

Security

• Private workspaces skip admin role bypass and group-role inheritance; non-member admins get the same denial class as unknown workspace IDs.

Added

• InvoicingCheck compose strip on project workspaces: soft deep links to create an invoice and open receivables filtered by workspaceId when InvoicingCheck is enabled (settlement stays in BudgetCheck).

Changed

• Uninstall: app removal still drops tables, config, and upgrade-backup snapshots; receipt attachment binaries in appdata are no longer deleted by the uninstall repair step.
• l10n: Locale catalog refresh across supported languages.

Added

• Mobile companion API v5: workspace-bound attachment download/preview endpoint (GET /api/mobile/v1/workspaces/{workspaceId}/attachments/{attachmentId}/download) streaming receipt bytes with nosniff, no-store, sanitized Content-Disposition, strict CSP for inline previews, and per-user rate limiting.
• Mobile companion API v4: monthly/yearly/period glance summaries (scope=month|year|all with new household span aggregation) and app-admin workspace creation mirroring the web permission model.
• Home category overview chips now carry a direction field and include income categories with activity, so the companion can split spending and income views.

Security / integrity

• Attachment delivery for the companion is bound to the requested workspace (resolveForDeliveryInWorkspace): a crafted attachment id from another workspace, or from a deleted transaction, is rejected with an opaque access-denied error (IDOR closed).
• Year/scope summary parameters are strictly validated (four-digit year window, whitelisted scopes) with 422 validation errors.

Fixed

• Mobile transaction list shape normalized; home category overview no longer drops income rows with activity.

Tests

• New behavior/contract suites for attachment download (workspace mismatch, deleted transaction, rate limit, header hygiene) and glance summaries; mobile-companion mutation harness extended (attachment workspace-bind and download mutations all killed).

Security / integrity

• Mobile mutation channel now requires a cryptographically valid CSRF token (IRequest::passesCSRFCheck()); forged non-empty requesttoken strings are rejected. Basic/Bearer app-password clients are unaffected.
• New exclusive workspace row lock (SELECT … FOR UPDATE) serializes monthly close/reopen against ledger writers: snapshot summary and hash are computed under the lock, and budget-target and attachment writes re-check closed state under the same lock (TOCTOU closed).
• Budget upsert collapses historical duplicate (workspace, month, category) rows under the write lock (NULL category_id is not uniquely indexed on all engines).
• Attachment overwrite (receipt crop bake) snapshots prior bytes and restores the stored file when the DB metadata update fails — disk never stays ahead of durable metadata.
• Adding or removing attachments on a transaction of a closed month is rejected.

Fixed

• Layout overflow hardening: cards, warnings list, and empty states wrap long titles instead of widening the app shell (min-width: 0 / max-width: 100% grid constraints).

Tests

• New snapshot-close serialization contract test; expanded update/delete CAS, mobile-channel, design-system CSS, and frontend-hardening suites; closeout and mobile-companion mutation harnesses cover the new gates.

Added

• In-app Support & Us admin surface with Partner CTAs.
• Public billing facades for InvoiceCheck (BillingReadFacade / BillingWriteFacade, including paid-state handshake).
• Mobile companion API surface (MobileApiController, capabilities, idempotent mutations).
• Playwright shell a11y smoke and epic-gate / closeout / billing mutation harnesses.

Security / integrity

• Transaction create/update/delete optimistic locking (version required; CAS on update/delete).
• CSRF-required mutation coverage; opaque AccessDenied IDOR gates.

Fixed

• Budgets navigation restored; warning recovery actions aligned with Dashboard.
• Money envelopes include decimals (zero-decimal currencies); header month follows selected month.
• Transaction dialog horizontal scrollbar; GET favorites remain read-only.
• Uninstall cleanup limited to upgrade-backup snapshots.

Changed

• Nextcloud compatibility 32–34; version sources aligned to 1.1.1.
• Stabilized money formatting; dropped versioned asset filename suffixes.

Fixed

• Monatsübersicht (Kategorieverbrauch): Der „Include one-off (special) transactions“-Schalter wird jetzt für die geplanten-vs.-tatsächlichen Kategorien korrekt angewendet, damit die Anzeige verständlich und konsistent ist.
• Audit-Härtung: Monatsabschluss-Snapshots (Close/Reopen) bleiben weiterhin kanonisch und unabhängig von der persönlichen Anzeige-Einstellung für „special“; dadurch bleibt der Berechnungs-Hash deterministisch.
• Robustheit: Wechseln der Anzeige-Einstellung lädt die Monatsdaten konsistent neu und ignoriert veraltete Antworten (vermeidet UI-Race-Conditions).

Changed

• Receipt gallery toolbar: grouped controls with tooltips, clearer hover/focus states, busy guards while saving, and a corrected rotate-clockwise icon.
• Gallery translations: attachment gallery strings are now translated across all supported locales (including regional variants).

Fixed

• Upgrade backup: snapshot folder creation failures (permissions, quota) now surface as UpgradeBackupException instead of escaping the backup handler.

Fixed

• Planned entries in summaries: dashboard, monthly, yearly, and close snapshots now exclude is_planned placeholder rows from income/expense/budget actual totals (they remain visible on the ledger until matched).
• Recurring generate: batch generation runs in a DB transaction, skips duplicate dates idempotently, blocks closed months, and deactivates rules that have passed their end date.
• Budget planned sync: month sync is transactional; zero-target categories no longer throw a misleading 403 when no budget row exists.

Changed

• Recurring rules table shows end date; modal adds active/inactive toggle and stronger end-date warnings (live region + save confirm).
• Yearly month cards show text badges for over-budget and closed states; recurring action buttons have unique accessible names.
• Modal focus lands on the first form field; dashboard warnings include severity text for screen readers.

Added

• Shared transaction editor: dashboard and ledger pages use a common inline editor for creating and editing bookings (transaction-editor.js).
• Dashboard quick actions: household dashboards show month-scoped shortcuts (new transaction, open ledger) with a compact recent-ledger preview.
• Transaction title fallback: blank titles default to the selected category name; unit tests cover resolution rules (TransactionTitleTest).

Changed

• Workspace settings for all members: non-managers can open settings to view workspace details and personal planning-total preferences; managers retain full configuration access.
• Transactions default window: the ledger opens on the current month instead of all time.
• Full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated for new UI strings.

Added

• Planning-total preferences: special transactions can be excluded from everyday planning totals by default, with per-user, server-persisted overrides and a manager-set workspace default (SummaryViewPreferencesService).
• Savings-transfer and planned-entry aggregation: summaries now match planned entries against actual transactions and aggregate savings transfers (PlannedTransactionMatchService).
• Dashboard transaction notes: transaction notes are shown on the dashboard.

Changed

• Special transactions are excluded from everyday planning totals by default; full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated accordingly.

Fixed

• Unbounded household transaction lists: household transaction lists are now properly bounded.

Added

• Import preferences API: server-synced CSV import defaults (ImportPreferencesService) with unit tests.
• Transaction import hardening: UTF-8 and legacy encoding fallback, fingerprint-based duplicate skip, expanded reference column aliases, and higher rate limits for split imports.

Changed

• CSV import UI: remove bank-type column from direction mapping; improved import page layout and validation feedback.

Fixed

• App access permissions (#2): users and groups on the directory allow-list can open BudgetCheck without a pre-existing workspace membership. Workspace data remains gated by per-workspace role checks.
• Group workspace membership counting: only honour group rows with assignable roles (viewer, contributor) when resolving effective access.

Added

• CSV transaction import: guided import page with preview validation and atomic commit (TransactionImportService, /import, API preview/commit endpoints).
• Unit tests for AccessControlService::canUseApp() allow-list behaviour (AccessControlAppAccessTest).
• Integration test for AppAccessMiddleware deny/allow flows against live app config (AppAccessGateIntegrationTest).

Changed

• Removed unused DENIAL_NO_WORKSPACE denial path; directory restriction is the sole app-entry gate.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable; full cleanup runs only on app removal.

Fixed

• EnsureBudgetCheckSchema: use the core Connection from the server container for MigrationService, so install/post-migration repair runs reliably on upgrade.

Added

• Integration tests for repair steps (UpgradeRepairIntegrationTest) and PHPUnit bootstrap support when tests run against a Nextcloud tree (NEXTCLOUD_ROOT / monorepo lib/base.php).

Changed

• Confirm Nextcloud 33 as max-version in appinfo/info.xml (aligned with latest stable server).

Added

• Searchable timezone and currency pickers on workspace and app settings: js/common/catalog-pickers.js with keyboard navigation, live filtering, and accessible combobox/listbox semantics; shared partials templates/common/bc-timezone-picker.php and bc-currency-picker.php.
• CurrencyCatalog: single source for supported ISO codes (including RUB, UAH, KZT); TimezoneCatalog: full IANA list exposed via catalog API.
• OCA\BudgetCheck\Repair\UninstallDropTables and EnsureBudgetCheckSchema wired in appinfo/info.xml for complete uninstall cleanup and idempotent schema repair on upgrade.
• Migration Version1009: schema/repair hardening for production installs; BudgetCheckTableCatalog centralizes table names.
• Tests: CurrencyCatalogTest, TimezoneCatalogTest, EnsureBudgetCheckSchemaTest, UninstallDropTablesTest, WorkspaceServiceUpdatePayloadTest.

Changed

• Workspace settings: server-side validation for timezone/currency; currency lock after the first transaction.
• App settings / settings UI: migrated to catalog pickers instead of plain text fields; styling in css/app.css.

• Fix App Store info.xml validation: screenshots before donation/dependencies, settings before navigations, drop unsupported keywords, cap at 10 screenshots (schema limit).

Changed

• shared app-feedback render (focus-ring + toast-dedup SSOT)
• Atlas farm v3.5.15: strict-id route reqs + contrast suite + l10n generator fix + test-harness cascade

Unreleased

Added

• CSV import: separate income and expense columns (issue #23): bank exports that split the amount into two columns — one value per row, the other left blank — now import without editing the file. Recognised headers include “Expenses”/“Income”, “Ausgaben”/“Einnahmen”, and “Debit”/“Credit” or “Soll”/“Haben” pairs when they contain amounts; a minus sign on the expense column is accepted, and a bare dash counts as empty. Ambiguous header names are decided by their data, so a single “Debit” column holding debit/credit keywords still works as a direction column. Extra columns such as a running balance are ignored.

Fixed

• API hardening: stricter request validation and error paths.
• Theme rendering now uses real OCS theming values; field-level error rendering synced from the shared component.
• Localization parity and catalog corpus fixes.

Changed

• Atlas v3.5.14 verification pass: expanded contract coverage; store screenshot URLs corrected.

Fixed

• Attachment View/Download 404 with doubled /index.php/ (#20): on installs without pretty URLs, linkToRoute already returns /index.php/apps/budgetcheck/.... The gallery was calling OC.generateUrl again and producing /index.php/index.php/.... Delete was unaffected (relative API paths). Companion app uses the mobile download API and was not affected.
• l10n parity: dropped orphan msgids with a literal \' (PHP-escape leak of “Copy last month's budget…”) from fr/nl/it/pl/pt_BR, reordered catalogs to match en.json, and hardened check-l10n-parity.php + sync-l10n-keys-from-en.php so this class of drift fails CI and is one command to repair.

Added

• Delete workspace (#19): managers can permanently remove a workspace from Settings → Workspace (typed-name confirmation, impact preview, cascade of bookings/attachments/budgets/members/snapshots). Project workspaces warn that InvoiceCheck invoices remain but settlement links break.
• Mobile companion API 7: DELETE /api/mobile/v1/workspaces/{id} with the same confirmName gate and rate limit (5/hour).

Security

• Workspace delete is manager-only (private workspaces: individual manager only; no app-admin bypass). Exact workspace-name confirmation required.

Added

• Recurring posting modes (#18): each rule chooses how dues land on the ledger.
• Book automatically (default for new rules): writes real transactions on Generate / when due.
• Plan for bank import (legacy behaviour, kept for existing rules): writes planned reminders that a matching import removes.
• Hourly RecurringDueJob: auto-books active book-mode rules when next_due_date is on or before today in the workspace timezone. Plan-mode rules stay manual.
• Catch-up actions: per-rule “Book now / Add plan now” for overdue dues, plus workspace “Add everything due”.
• Generate can promote an existing planned twin to a real booking when switching to book mode (idempotent per rule+date).

Changed

• Recurring settings UX rewritten for clarity (two modes, due badges, simpler verbs). WCAG 2.1 AA focus/labels retained.
• Contributors see Settings → Recurring for catch-up only (Book / Add plan / Add everything due); create/edit/delete stay managers-only. Viewers stay redirected.
• Inactive rules no longer offer Book/Add plan (plain “Paused” hint); Due badges expose an accessible name.
• Real ledger rows may keep recurring_rule_id for provenance; uniqueness is one live row per (rule, date).
• Closed months are skipped during generate/auto-due so the cursor never stalls forever.
• Mobile recurring suggestions read amount.minor from the hydrated envelope (fixes always-zero amounts).
• Full BudgetCheck native-speaker quality pass (web + companion): register (Sie/vous/usted/u/Lei), Transactions nav binding, workspace-manager role terms, untranslated lock/offline mobile strings, glossary alignment (PL Księgowania; IT button chrome vs Lei body).

Fixed

• Book + import no longer doubles: matching bank/manual bookings (no recurring_rule_id) soft-delete the live book-mode auto-book. Recurring generate itself never replaces sibling months (adjacent-month matcher is import-only).
• Dev cron sidecar: nextcloud-cron service + backgroundjobs_mode=cron so RecurringDueJob runs without web traffic. List recurring also does a rate-limited opportunistic due sweep.
• Mobile recurring UI: Start → “Add what is due” screen with Book now (wired to generate-due API).

Security

• Auto-due uses the rule author (fallback: earliest workspace manager) under the same contributor ACL as manual Generate; FOR UPDATE on the rule prevents double-posts under concurrent job + UI.
• Add full period (mode=full_period / future through) is managers-only at API and service layer; contributors retain due catch-up Generate (dueCatchUp + through ≤ today).

Fixed

• Rate limits for LDAP/AD UUID user ids (#17): counters are stored in per-user preferences (rate_limit:{action}) instead of embedding the userId in an oc_appconfig key (VARCHAR(64)). Favoriting workspaces and other rate-limited actions work for UUID-style UIDs; exclusive locking also respects the 64-char oc_file_locks key limit.

Changed

• l10n glossary alignment: corrected wrong translations and standardised button labels across all shipped locales to match the cross-app glossary.
• Help, Support & Us / Get the App: WCAG 2.1 AA hardening and translated footer copy for all website footer locales.
• CI: collapsed GitHub Actions to a single PHP syntax-only smoke job; full test suites stay local.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Added

• Brazilian Portuguese (pt_BR): full UI catalog (l10n/pt_BR.json / pt_BR.js).

Changed

• l10n tooling: parity / regenerate / sync scripts recognise pt_BR.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Changed

• Sole-manager private workspaces: converting standard → private no longer requires a second manager. Demoting/removing managers uses the normal last-manager rule (≥1). Groups are still forbidden on private workspaces.
• Confirmation and help copy warn that if the sole manager account is removed, the private workspace cannot be opened in BudgetCheck (host/DB recovery only).

Added

• Private workspaces (ACL confidential mode): managers can mark a workspace private so Nextcloud system admins and BudgetCheck app admins who are not members cannot see it in lists or open workspace-scoped APIs. Host/DB disclosure is shown before enabling private (not E2EE).
• Create rules: any user who can open the app may create a private workspace; standard workspace create remains app-admin-only.
• Companion API 6: mobile clients can create with privacyMode and update privacy via PUT /api/mobile/v1/workspaces/{id} under the same dual-manager / no-groups guards.
• Web and companion UX for privacy mode (settings fieldset, create modal, members group lock, Private badge).

Changed

• Converting a standard workspace to private requires ≥2 individual managers and no Nextcloud group memberships; private workspaces allow individuals only.
• Member demote/remove and privacy toggles serialize with workspace row locks to avoid last-manager races.
• Favorites / last-used and admin digest surfaces clip or opaque-count private workspaces (no name/id leak to non-members).

Security

• Private workspaces skip admin role bypass and group-role inheritance; non-member admins get the same denial class as unknown workspace IDs.

Added

• InvoicingCheck compose strip on project workspaces: soft deep links to create an invoice and open receivables filtered by workspaceId when InvoicingCheck is enabled (settlement stays in BudgetCheck).

Changed

• Uninstall: app removal still drops tables, config, and upgrade-backup snapshots; receipt attachment binaries in appdata are no longer deleted by the uninstall repair step.
• l10n: Locale catalog refresh across supported languages.

Added

• Mobile companion API v5: workspace-bound attachment download/preview endpoint (GET /api/mobile/v1/workspaces/{workspaceId}/attachments/{attachmentId}/download) streaming receipt bytes with nosniff, no-store, sanitized Content-Disposition, strict CSP for inline previews, and per-user rate limiting.
• Mobile companion API v4: monthly/yearly/period glance summaries (scope=month|year|all with new household span aggregation) and app-admin workspace creation mirroring the web permission model.
• Home category overview chips now carry a direction field and include income categories with activity, so the companion can split spending and income views.

Security / integrity

• Attachment delivery for the companion is bound to the requested workspace (resolveForDeliveryInWorkspace): a crafted attachment id from another workspace, or from a deleted transaction, is rejected with an opaque access-denied error (IDOR closed).
• Year/scope summary parameters are strictly validated (four-digit year window, whitelisted scopes) with 422 validation errors.

Fixed

• Mobile transaction list shape normalized; home category overview no longer drops income rows with activity.

Tests

• New behavior/contract suites for attachment download (workspace mismatch, deleted transaction, rate limit, header hygiene) and glance summaries; mobile-companion mutation harness extended (attachment workspace-bind and download mutations all killed).

Security / integrity

• Mobile mutation channel now requires a cryptographically valid CSRF token (IRequest::passesCSRFCheck()); forged non-empty requesttoken strings are rejected. Basic/Bearer app-password clients are unaffected.
• New exclusive workspace row lock (SELECT … FOR UPDATE) serializes monthly close/reopen against ledger writers: snapshot summary and hash are computed under the lock, and budget-target and attachment writes re-check closed state under the same lock (TOCTOU closed).
• Budget upsert collapses historical duplicate (workspace, month, category) rows under the write lock (NULL category_id is not uniquely indexed on all engines).
• Attachment overwrite (receipt crop bake) snapshots prior bytes and restores the stored file when the DB metadata update fails — disk never stays ahead of durable metadata.
• Adding or removing attachments on a transaction of a closed month is rejected.

Fixed

• Layout overflow hardening: cards, warnings list, and empty states wrap long titles instead of widening the app shell (min-width: 0 / max-width: 100% grid constraints).

Tests

• New snapshot-close serialization contract test; expanded update/delete CAS, mobile-channel, design-system CSS, and frontend-hardening suites; closeout and mobile-companion mutation harnesses cover the new gates.

Added

• In-app Support & Us admin surface with Partner CTAs.
• Public billing facades for InvoiceCheck (BillingReadFacade / BillingWriteFacade, including paid-state handshake).
• Mobile companion API surface (MobileApiController, capabilities, idempotent mutations).
• Playwright shell a11y smoke and epic-gate / closeout / billing mutation harnesses.

Security / integrity

• Transaction create/update/delete optimistic locking (version required; CAS on update/delete).
• CSRF-required mutation coverage; opaque AccessDenied IDOR gates.

Fixed

• Budgets navigation restored; warning recovery actions aligned with Dashboard.
• Money envelopes include decimals (zero-decimal currencies); header month follows selected month.
• Transaction dialog horizontal scrollbar; GET favorites remain read-only.
• Uninstall cleanup limited to upgrade-backup snapshots.

Changed

• Nextcloud compatibility 32–34; version sources aligned to 1.1.1.
• Stabilized money formatting; dropped versioned asset filename suffixes.

Fixed

• Monatsübersicht (Kategorieverbrauch): Der „Include one-off (special) transactions“-Schalter wird jetzt für die geplanten-vs.-tatsächlichen Kategorien korrekt angewendet, damit die Anzeige verständlich und konsistent ist.
• Audit-Härtung: Monatsabschluss-Snapshots (Close/Reopen) bleiben weiterhin kanonisch und unabhängig von der persönlichen Anzeige-Einstellung für „special“; dadurch bleibt der Berechnungs-Hash deterministisch.
• Robustheit: Wechseln der Anzeige-Einstellung lädt die Monatsdaten konsistent neu und ignoriert veraltete Antworten (vermeidet UI-Race-Conditions).

Changed

• Receipt gallery toolbar: grouped controls with tooltips, clearer hover/focus states, busy guards while saving, and a corrected rotate-clockwise icon.
• Gallery translations: attachment gallery strings are now translated across all supported locales (including regional variants).

Fixed

• Upgrade backup: snapshot folder creation failures (permissions, quota) now surface as UpgradeBackupException instead of escaping the backup handler.

Fixed

• Planned entries in summaries: dashboard, monthly, yearly, and close snapshots now exclude is_planned placeholder rows from income/expense/budget actual totals (they remain visible on the ledger until matched).
• Recurring generate: batch generation runs in a DB transaction, skips duplicate dates idempotently, blocks closed months, and deactivates rules that have passed their end date.
• Budget planned sync: month sync is transactional; zero-target categories no longer throw a misleading 403 when no budget row exists.

Changed

• Recurring rules table shows end date; modal adds active/inactive toggle and stronger end-date warnings (live region + save confirm).
• Yearly month cards show text badges for over-budget and closed states; recurring action buttons have unique accessible names.
• Modal focus lands on the first form field; dashboard warnings include severity text for screen readers.

Added

• Shared transaction editor: dashboard and ledger pages use a common inline editor for creating and editing bookings (transaction-editor.js).
• Dashboard quick actions: household dashboards show month-scoped shortcuts (new transaction, open ledger) with a compact recent-ledger preview.
• Transaction title fallback: blank titles default to the selected category name; unit tests cover resolution rules (TransactionTitleTest).

Changed

• Workspace settings for all members: non-managers can open settings to view workspace details and personal planning-total preferences; managers retain full configuration access.
• Transactions default window: the ledger opens on the current month instead of all time.
• Full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated for new UI strings.

Added

• Planning-total preferences: special transactions can be excluded from everyday planning totals by default, with per-user, server-persisted overrides and a manager-set workspace default (SummaryViewPreferencesService).
• Savings-transfer and planned-entry aggregation: summaries now match planned entries against actual transactions and aggregate savings transfers (PlannedTransactionMatchService).
• Dashboard transaction notes: transaction notes are shown on the dashboard.

Changed

• Special transactions are excluded from everyday planning totals by default; full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated accordingly.

Fixed

• Unbounded household transaction lists: household transaction lists are now properly bounded.

Added

• Import preferences API: server-synced CSV import defaults (ImportPreferencesService) with unit tests.
• Transaction import hardening: UTF-8 and legacy encoding fallback, fingerprint-based duplicate skip, expanded reference column aliases, and higher rate limits for split imports.

Changed

• CSV import UI: remove bank-type column from direction mapping; improved import page layout and validation feedback.

Fixed

• App access permissions (#2): users and groups on the directory allow-list can open BudgetCheck without a pre-existing workspace membership. Workspace data remains gated by per-workspace role checks.
• Group workspace membership counting: only honour group rows with assignable roles (viewer, contributor) when resolving effective access.

Added

• CSV transaction import: guided import page with preview validation and atomic commit (TransactionImportService, /import, API preview/commit endpoints).
• Unit tests for AccessControlService::canUseApp() allow-list behaviour (AccessControlAppAccessTest).
• Integration test for AppAccessMiddleware deny/allow flows against live app config (AppAccessGateIntegrationTest).

Changed

• Removed unused DENIAL_NO_WORKSPACE denial path; directory restriction is the sole app-entry gate.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable; full cleanup runs only on app removal.

Fixed

• EnsureBudgetCheckSchema: use the core Connection from the server container for MigrationService, so install/post-migration repair runs reliably on upgrade.

Added

• Integration tests for repair steps (UpgradeRepairIntegrationTest) and PHPUnit bootstrap support when tests run against a Nextcloud tree (NEXTCLOUD_ROOT / monorepo lib/base.php).

Changed

• Confirm Nextcloud 33 as max-version in appinfo/info.xml (aligned with latest stable server).

Added

• Searchable timezone and currency pickers on workspace and app settings: js/common/catalog-pickers.js with keyboard navigation, live filtering, and accessible combobox/listbox semantics; shared partials templates/common/bc-timezone-picker.php and bc-currency-picker.php.
• CurrencyCatalog: single source for supported ISO codes (including RUB, UAH, KZT); TimezoneCatalog: full IANA list exposed via catalog API.
• OCA\BudgetCheck\Repair\UninstallDropTables and EnsureBudgetCheckSchema wired in appinfo/info.xml for complete uninstall cleanup and idempotent schema repair on upgrade.
• Migration Version1009: schema/repair hardening for production installs; BudgetCheckTableCatalog centralizes table names.
• Tests: CurrencyCatalogTest, TimezoneCatalogTest, EnsureBudgetCheckSchemaTest, UninstallDropTablesTest, WorkspaceServiceUpdatePayloadTest.

Changed

• Workspace settings: server-side validation for timezone/currency; currency lock after the first transaction.
• App settings / settings UI: migrated to catalog pickers instead of plain text fields; styling in css/app.css.

• Fix App Store info.xml validation: screenshots before donation/dependencies, settings before navigations, drop unsupported keywords, cap at 10 screenshots (schema limit).