DutyCheck - Releases

Fixed

• “Assign pattern” always failed with a misleading overlap error: assignments left behind by deleted (deactivated) patterns still counted as overlapping — invisible in the UI and impossible to end. Only assignments on active patterns now block; rows on inactive or missing patterns are ignored, matching every other reader. The assign dialog also lists the employee’s existing assignments, auto-ticks “End previous overlapping assignment” when the start date collides, and ASSIGNMENT_OVERLAP now names the real cause instead of talking about shifts.
• Orphan assignments for nonexistent employees: the employee check in POST …/assign only ran in multi-company installs — single-company setups accepted any employee id and wrote rows that could never resolve. The endpoint now always verifies the employee exists (EMPLOYEE_NOT_FOUND).

Changed

• Rotation cycles up to 8 weeks: allowed cycleWeeks widened from 1–4 to 1–8 so non-week-aligned rhythms are representable (e.g. 4-on/2-off needs a 6-week cycle). A stored [1,2,3,4] — the old default that settings saves auto-persisted — now widens to the full range; explicitly narrowed lists are still honoured.

Fixed

• API hardening: stricter request validation and error paths.
• Localization fixes.

Changed

• Atlas v3.5.14 verification pass: expanded contract coverage; store screenshot URLs corrected.

Fixed

• Shifts can be deleted from the edit dialog: opening a filled roster cell showed only “Save changes / Cancel” — the “Cancel shift” action that existed on the assignments table row is now also available inside the edit dialog (danger secondary action), so a manually entered shift can be removed from either surface.
• Access page could not remove people: saving the app policy re-validated stored allowlist entries — a user or group deleted in Nextcloud meanwhile made every save fail, so removals never persisted and leaving the page always warned about unsaved changes. Stored entries that no longer resolve are now pruned (and reported back) while newly added entries are still strictly validated. Removing an entry also announces that “Save app policy” is still needed.
• Roster error rows get a working Retry and an empty/failed roster grid no longer leaves a dead keyboard tab stop.
• Pattern days corrupted on save: the web client posts urlencoded bodies, so an unchecked day arrived as the string "false" and PHP's (bool) cast stored every day as working. Strict boolean parsing (ApiMutationParams::boolValue*) now honours true/false/1/0/on/off/yes/no on every affected endpoint — patterns reopen with exactly the days you marked.
• Duty & team settings flipped everything ON: the same "false" → true coercion is fixed for all toggles; ambiguous values now fail with INVALID_BOOLEAN instead of silently turning features on.
• Patterns can now be deleted: new danger Delete action with confirmation; patterns are soft-deactivated (assignments keep their history) and no longer clutter the list.
• Delete could still be refused after settings changes: deactivation no longer re-validates the stored cycle_weeks against the current allowed list and no longer requires the rotation feature flag — a pattern can always be deactivated. Unchanged stored values are only validated when actually changed.
• Suggest fill filled nothing: the preview no longer inherits the “Add assignment” form’s location as a hidden filter, and location-filter drops are counted and shown (“Skipped (location filter): n”) instead of a misleading “nothing to fill”.
• Open shifts could not be deleted: OpenShiftService::discardOpen() existed internally but no route exposed it — a posted open shift stayed forever. The roster now lists posted open shifts with a Delete action (DELETE /api/open-shifts/{id}); shifts with a pending or approved claim refuse deletion.
• Location qualification requirements were permanent: requireForLocation had no inverse — DELETE /api/locations/{id}/qualifications/{qualificationId} (+ POST detach alias) removes a requirement, and each qualification chip now lists its required locations with a Remove action.
• Swap requests could not be withdrawn: the requester had no way to take back a pending swap. New POST /api/my/swaps/{id}/withdraw (requester-only, race-safe) shows “Withdraw swap request” on My roster, with companion parity via /api/mobile/my/swaps + /api/mobile/swaps/{id}/withdraw.
• Shift template active flag silently reset: ShiftTemplateService::update cast the flag via (int), turning "true" into 0 — now parsed strictly like every other boolean field.
• Session CSRF guard: the web client no longer sends OCS-APIRequest (a header that tells Nextcloud to skip its CSRF check), and a new SessionCsrfMiddleware re-validates the request token server-side for every session-authenticated mutation regardless of that header — a forged or malformed request can no longer opt out by claiming to be an API client.
• Release tarball shipped dev artifacts: make release packed vendor/ (all dev-deps — the app has zero runtime composer requirements), docs/atlas evidence files, phpunit.xml, playwright.config.js, and a stray .auth/ dir — ~27 MB of non-product content. The excludes now drop them and verify-release fails if they return; the archive is ~3 MB of product only.
• Small-screen accessibility: the roster scroller is keyboard-focusable exactly while it actually scrolls (axe scrollable-region-focusable), and the access-state panel wraps instead of overflowing at 320 px.

Tests

• Unit: strict-bool parser, urlencoded filterPatch/weekDays normalisation, stale-allowlist pruning on policy save; JS source contracts for the modal delete parity + removal cue; Playwright spec covering the pattern round-trip + delete, settings persistence, modal delete parity, and the suggest request contract.

Fixed

• Conflict thresholds callout: “Apply to open periods” is shown only when open periods still use older caps (no grey dead button after Save when already in sync). Soft/hard HTML max aligned with server clamps.
• Roster copy: “Apply copy” stays hidden until Preview reports something to copy (same omit-over-disable pattern).
• Conflict rematerialize: After threshold save/apply, budget-dirty open periods rematerialize so stale hard caps do not linger; concurrent sibling writers get clear already-decided handling where applicable.

Changed

• App Store / GitHub release cut from the conflict-threshold source on master (correct v0.3.3 tag); packaging and App Store signature refreshed for upload.

Added

• Conflict thresholds → Apply to open periods: saving live caps no longer leaves planners stuck; app admins can re-freeze the current policy onto every open period in one click (published/closed stay unchanged; audit CONFLICT_THRESHOLDS_REAPPLIED).
• Settings callout explains the create-time freeze; live ≈ hours hints next to minute fields; period/week dual-use of soft/hard caps is labelled plainly.
• Dashboard planning status shows a freeze hint with a deep link when hard period/week hour caps are blocking publish.

Tests

• Unit apply/status + settings/dashboard template contracts; integrity mutation asserts; Playwright axe on /settings/conflicts.

Fixed

• Settings → Mobile license: tall license/seats page could not scroll to the bottom. #app-content is now the vertical scrollport; unpaired overflow-x: clip on the shell (CSS Overflow L3 y-axis clip) is removed so the seats table stays reachable.

Changed

• Keep Nextcloud 32–35 (max-version 35).

Added — Roster Self-Service GA (DC-AZC-ROSTER-GA-1)

• N-week rotation patterns (1–4): CRUD, per-employee assign, forward-only anchors, suggest-fill preview/confirm with period mutex
• Soll facade (EffectiveTargetHoursFacade v1) for ArbeitszeitCheck opt-in; sealed months ignore live drift
• Peer Team week (default off), bilateral swap path sharing planner CAS apply, preferences (Früh/Spät bands), hard blackouts
• Today board (“Wer ist wo?”) planner-only; Dienst & Team settings section (Bachus first-paint toggles)
• Push quiet hours with bounded queue (200/user, 24h TTL); legacy companies default off, new companies on
• ICS Mobile create/copy/rotate + global IP spray rate limit; Duty Mobile Bachus tabs Heute · Woche · Team
• Security: IDOR on peer/Today/blackouts/swaps; no preference free-text; ICS token never logged

Security / architecture

• Swap/bilateral apply is a single Duty DB transaction + assignment version CAS
• Suggest confirm all-or-nothing under dc_period_locks
• Quiet push queue bounded (Zeus FM-QH-01)
• Cross-app: read-only facade only — no shared transactions / no AZC SQL on dc_*

Fixed

• “Assign pattern” always failed with a misleading overlap error: assignments left behind by deleted (deactivated) patterns still counted as overlapping — invisible in the UI and impossible to end. Only assignments on active patterns now block; rows on inactive or missing patterns are ignored, matching every other reader. The assign dialog also lists the employee’s existing assignments, auto-ticks “End previous overlapping assignment” when the start date collides, and ASSIGNMENT_OVERLAP now names the real cause instead of talking about shifts.
• Orphan assignments for nonexistent employees: the employee check in POST …/assign only ran in multi-company installs — single-company setups accepted any employee id and wrote rows that could never resolve. The endpoint now always verifies the employee exists (EMPLOYEE_NOT_FOUND).

Changed

• Rotation cycles up to 8 weeks: allowed cycleWeeks widened from 1–4 to 1–8 so non-week-aligned rhythms are representable (e.g. 4-on/2-off needs a 6-week cycle). A stored [1,2,3,4] — the old default that settings saves auto-persisted — now widens to the full range; explicitly narrowed lists are still honoured.

Fixed

• API hardening: stricter request validation and error paths.
• Localization fixes.

Changed

• Atlas v3.5.14 verification pass: expanded contract coverage; store screenshot URLs corrected.

Fixed

• Shifts can be deleted from the edit dialog: opening a filled roster cell showed only “Save changes / Cancel” — the “Cancel shift” action that existed on the assignments table row is now also available inside the edit dialog (danger secondary action), so a manually entered shift can be removed from either surface.
• Access page could not remove people: saving the app policy re-validated stored allowlist entries — a user or group deleted in Nextcloud meanwhile made every save fail, so removals never persisted and leaving the page always warned about unsaved changes. Stored entries that no longer resolve are now pruned (and reported back) while newly added entries are still strictly validated. Removing an entry also announces that “Save app policy” is still needed.
• Roster error rows get a working Retry and an empty/failed roster grid no longer leaves a dead keyboard tab stop.
• Pattern days corrupted on save: the web client posts urlencoded bodies, so an unchecked day arrived as the string "false" and PHP's (bool) cast stored every day as working. Strict boolean parsing (ApiMutationParams::boolValue*) now honours true/false/1/0/on/off/yes/no on every affected endpoint — patterns reopen with exactly the days you marked.
• Duty & team settings flipped everything ON: the same "false" → true coercion is fixed for all toggles; ambiguous values now fail with INVALID_BOOLEAN instead of silently turning features on.
• Patterns can now be deleted: new danger Delete action with confirmation; patterns are soft-deactivated (assignments keep their history) and no longer clutter the list.
• Delete could still be refused after settings changes: deactivation no longer re-validates the stored cycle_weeks against the current allowed list and no longer requires the rotation feature flag — a pattern can always be deactivated. Unchanged stored values are only validated when actually changed.
• Suggest fill filled nothing: the preview no longer inherits the “Add assignment” form’s location as a hidden filter, and location-filter drops are counted and shown (“Skipped (location filter): n”) instead of a misleading “nothing to fill”.
• Open shifts could not be deleted: OpenShiftService::discardOpen() existed internally but no route exposed it — a posted open shift stayed forever. The roster now lists posted open shifts with a Delete action (DELETE /api/open-shifts/{id}); shifts with a pending or approved claim refuse deletion.
• Location qualification requirements were permanent: requireForLocation had no inverse — DELETE /api/locations/{id}/qualifications/{qualificationId} (+ POST detach alias) removes a requirement, and each qualification chip now lists its required locations with a Remove action.
• Swap requests could not be withdrawn: the requester had no way to take back a pending swap. New POST /api/my/swaps/{id}/withdraw (requester-only, race-safe) shows “Withdraw swap request” on My roster, with companion parity via /api/mobile/my/swaps + /api/mobile/swaps/{id}/withdraw.
• Shift template active flag silently reset: ShiftTemplateService::update cast the flag via (int), turning "true" into 0 — now parsed strictly like every other boolean field.
• Session CSRF guard: the web client no longer sends OCS-APIRequest (a header that tells Nextcloud to skip its CSRF check), and a new SessionCsrfMiddleware re-validates the request token server-side for every session-authenticated mutation regardless of that header — a forged or malformed request can no longer opt out by claiming to be an API client.
• Release tarball shipped dev artifacts: make release packed vendor/ (all dev-deps — the app has zero runtime composer requirements), docs/atlas evidence files, phpunit.xml, playwright.config.js, and a stray .auth/ dir — ~27 MB of non-product content. The excludes now drop them and verify-release fails if they return; the archive is ~3 MB of product only.
• Small-screen accessibility: the roster scroller is keyboard-focusable exactly while it actually scrolls (axe scrollable-region-focusable), and the access-state panel wraps instead of overflowing at 320 px.

Tests

• Unit: strict-bool parser, urlencoded filterPatch/weekDays normalisation, stale-allowlist pruning on policy save; JS source contracts for the modal delete parity + removal cue; Playwright spec covering the pattern round-trip + delete, settings persistence, modal delete parity, and the suggest request contract.

Fixed

• Conflict thresholds callout: “Apply to open periods” is shown only when open periods still use older caps (no grey dead button after Save when already in sync). Soft/hard HTML max aligned with server clamps.
• Roster copy: “Apply copy” stays hidden until Preview reports something to copy (same omit-over-disable pattern).
• Conflict rematerialize: After threshold save/apply, budget-dirty open periods rematerialize so stale hard caps do not linger; concurrent sibling writers get clear already-decided handling where applicable.

Changed

• App Store / GitHub release cut from the conflict-threshold source on master (correct v0.3.3 tag); packaging and App Store signature refreshed for upload.

Added

• Conflict thresholds → Apply to open periods: saving live caps no longer leaves planners stuck; app admins can re-freeze the current policy onto every open period in one click (published/closed stay unchanged; audit CONFLICT_THRESHOLDS_REAPPLIED).
• Settings callout explains the create-time freeze; live ≈ hours hints next to minute fields; period/week dual-use of soft/hard caps is labelled plainly.
• Dashboard planning status shows a freeze hint with a deep link when hard period/week hour caps are blocking publish.

Tests

• Unit apply/status + settings/dashboard template contracts; integrity mutation asserts; Playwright axe on /settings/conflicts.

Fixed

• Settings → Mobile license: tall license/seats page could not scroll to the bottom. #app-content is now the vertical scrollport; unpaired overflow-x: clip on the shell (CSS Overflow L3 y-axis clip) is removed so the seats table stays reachable.

Changed

• Keep Nextcloud 32–35 (max-version 35).

Added — Roster Self-Service GA (DC-AZC-ROSTER-GA-1)

• N-week rotation patterns (1–4): CRUD, per-employee assign, forward-only anchors, suggest-fill preview/confirm with period mutex
• Soll facade (EffectiveTargetHoursFacade v1) for ArbeitszeitCheck opt-in; sealed months ignore live drift
• Peer Team week (default off), bilateral swap path sharing planner CAS apply, preferences (Früh/Spät bands), hard blackouts
• Today board (“Wer ist wo?”) planner-only; Dienst & Team settings section (Bachus first-paint toggles)
• Push quiet hours with bounded queue (200/user, 24h TTL); legacy companies default off, new companies on
• ICS Mobile create/copy/rotate + global IP spray rate limit; Duty Mobile Bachus tabs Heute · Woche · Team
• Security: IDOR on peer/Today/blackouts/swaps; no preference free-text; ICS token never logged

Security / architecture

• Swap/bilateral apply is a single Duty DB transaction + assignment version CAS
• Suggest confirm all-or-nothing under dc_period_locks
• Quiet push queue bounded (Zeus FM-QH-01)
• Cross-app: read-only facade only — no shared transactions / no AZC SQL on dc_*

Fixed

• Translations: roster/catalog window status lines and “(opens in a new tab)” are translated in every shipped locale (de/fr/es/da/nl/it/pl/sv/nb/pt_BR), not left as English identity leftovers. Placeholders {from}, {to}, and {total} stay in the same order as the msgid.
• l10n glossary alignment: corrected wrong translations and standardised button labels across all shipped locales to match the cross-app glossary.

Changed

• Help, Support & Us / Get the App: WCAG 2.1 AA hardening and translated footer copy for all website footer locales.
• CI: collapsed GitHub Actions to a single PHP syntax-only smoke job; full test suites stay local.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Tests

• l10n catalog integrity PHPUnit + JS contract; CI runs check-l10n-placeholders.php (including pt_BR and regional variants) and run-l10n-catalog-mutations.php.

Fixed

• Language vs locale: DutyCheck now honours Nextcloud Language for UI text (lang, relative time, weekday names) and Locale for date order and first day of week. English UI with a Dutch locale no longer presents the interface in Dutch. The header shows Start of week from Locale, named in Language.
• Translations: planning “period” is no longer translated as menstruation (Dutch menstruatie, Swedish mens, French règles, Italian ciclo). Empty-state copy uses the time-range sense in nl/fr/it/sv/pl. Work “shift” is no longer translated as displacement/change (Dutch verschuiving, Italian spostamento, French changement, Danish Kravskifte, Spanish turno de reclamo).
• Speed: Periods, Dashboard pulse, Absences, and Roster GET no longer load a full conflict recompute for a button click. GET publish-readiness and roster reads use persisted conflicts; overlap checks group by employee; absence collisions are batched. Writes (assign/publish/close) still refresh.

Changed

• Version lockstep 0.1.42. Nextcloud max-version remains 34 (current stable 34.0.3).

Added

• Brazilian Portuguese (pt_BR): UI catalog (l10n/pt_BR.json / pt_BR.js).

Fixed

• Activity provider (NC 34): unknown / foreign activity events throw OCP\Activity\Exceptions\UnknownActivityException instead of \InvalidArgumentException, matching the Activity API contract.

Changed

• l10n: locale catalogs refreshed for parity; tooling accepts pt_BR.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Fixed

• ArbeitszeitCheck integration “Sync now”: per-admin rate-limiter config keys no longer exceed Nextcloud’s 64-character oc_appconfig.configkey limit (full SHA-256 digest was producing 89-character keys and HTTP 400). Manual sync works again; background reconcile was unaffected.

Changed

• German locales (de / de_DE): formal Sie-address and clearer duty-planning, period, conflict, and license copy.

Accessibility / UX

• Setup progress WCAG fix (NC34). Done-step checkmarks no longer paint --color-primary-element-text (white) on --color-success. On Nextcloud 34, --color-success is a pale surface (#D8F3DA) — white-on-success measured ~1.18:1 (fails 1.4.11). Done status now uses --color-success-text on the success surface with an --color-element-success ring (same contract as status badges).
• One next step. Setup checklist collapses done rows, highlights only the current gate, and shows a single primary CTA. Misleading “each item links” copy removed. Quick start is suppressed while setup gates remain so onboarding is not duplicated.
• E2E fixture proves done-status contrast ≥ 4.5:1 under live theme tokens; JS + CSS contract tests lock the ink token.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable; full cleanup runs only on app removal.

Fixed

• Employee and location saves no longer hit the wrong URL or silently empty the list. js/common/api.js now resolves every app-relative path through OC.generateUrl for GET, POST, PUT, and DELETE (mutations previously skipped this and could 404 on hosts that require /index.php/). After a successful save, the Employees and Locations pages reload the catalog from the server instead of trusting a stale empty data array.
• Updates use POST as well as PUT (/api/employees/{id}, /api/locations/{id}) so reverse proxies that block PUT still persist edits.
• Incomplete database schema returns SCHEMA_NOT_READY (503) with a clear message instead of a generic failure when dc_employees (or other tables) are missing.
• German translations for the dashboard “Setup progress” checklist and related setup strings (were still showing English on de / de_DE locales).

Fixed

• Install and upgrade path hardened. appinfo/info.xml now declares MySQL/PostgreSQL under <dependencies> (required by MigrationService for correct schema checks), and EnsureDutyCheckSchema runs on install and post-migration to recreate any missing tables and fail loudly in occ upgrade logs instead of leaving a half-installed app with no UI feedback. Schema repair uses OC\DB\Connection for MigrationService, matching core occ upgrade.
• Dashboard setup progress. Planners see a persistent “Setup progress” checklist (schema, employees, locations, open period) with direct links until planning is possible; incomplete database setup shows a critical alert and an audible error message.
• Integration and policy errors use targeted messages in messaging.js (peer app missing/disabled/too old, sync throttled, legacy absences, access list required) instead of a generic “Something went wrong”.
• Settings integration load failures now surface via the shared error handler (toast + live region), not only a silent banner.
• Navigation boot failures are logged to nextcloud.log instead of being swallowed in Application::boot().

Added

• tests/Integration/UpgradeRepairIntegrationTest.php and EnsureDutyCheckSchemaTest to guard the production upgrade container path.

Fixed

• Roster "Create assignment" form layout. On the tablet/desktop grid the start- and end-time fields were placed in columns 2–3, leaving a gap in the first column and pushing the break field out of alignment. Start now sits in column 1 and end in column 2, so the day/time row lines up cleanly with the rest of the form.

Changed

• Mobile-first responsive layout. The stylesheet now builds up from a small-screen base (min-width: 480px / 768px breakpoints) instead of patching a desktop layout downward. Shell, cards, page header, filter and form grids reflow cleanly from phone to desktop, and overflow-x: clip prevents the stray horizontal scrollbar on narrow viewports.
• Tables collapse to cards on small screens. Data tables render as stacked, labelled cards below the tablet breakpoint (row headers and data-cell labels) and switch back to a normal table on wider screens, keeping rosters and lists readable on phones (WCAG 2.1 AA reflow).
• Tighter page header with a smaller icon and a dedicated actions area so primary actions stay reachable on mobile.

Security

• Hardened CI workflow and refreshed the Composer lock file to pull in the patched Symfony release (CVE fix), keeping bundled dependencies current.

Fixed

• Mutations no longer fail with an opaque REQUEST_FAILED after the CSRF token rotates. The shared API client (js/common/api.js) now transparently refreshes the request token from /csrftoken and retries a write once on 412 — the same recovery @nextcloud/axios performs for the rest of the Nextcloud frontend. This fixes "Add employee" (and every other create/update) failing on long-lived or multi-tab sessions, where the failure left no entry in nextcloud.log (CSRF rejections are handled in middleware and are never logged). Retrying is safe because a 412 is rejected before any database write occurs.
• Clear, localized error messages (js/common/messaging.js): expired tokens/sessions now tell the user to reload, and internal codes (REQUEST_FAILED, INTERNAL_ERROR, …) are never shown raw. German translations added.
• Editing or deactivating an employee whose linked Nextcloud account was deleted no longer fails. RosterService::updateEmployee only re-validates the linked account when it actually changes; an unchanged, now-missing link stays manageable so the record is never frozen. A new (or changed) link to a missing account is still rejected.

Changed

• App Store listing copy refreshed for broader appeal (appinfo/info.xml: summary + long description, EN + DE).

Added

• Searchable IANA timezone picker on the locations page: js/common/timezone-picker.js with keyboard navigation, live filtering, and accessible listbox semantics; backed by TimezoneCatalog and a new read-only catalog API (CatalogApiController).
• OCA\DutyCheck\Repair\UninstallDropTables wired in appinfo/info.xml so disabling the app drops all dutycheck tables, migration rows, and app config.

Changed

• TimezoneCatalog: expanded IANA coverage and unit tests (TimezoneCatalogTest); roster/location flows use the shared picker instead of a plain text field.
• Locations UI: timezone field uses the new picker component; styling in css/app.css for the combobox pattern (WCAG-friendly focus and contrast).

Bumped

• Nextcloud max-version: 33 (latest stable major).

Fixed

• App Store info.xml: use https:// for author homepage, website, and donation URL (matches ProjectCheck; store schema requires https://.+).

Fixed

• “Assign pattern” always failed with a misleading overlap error: assignments left behind by deleted (deactivated) patterns still counted as overlapping — invisible in the UI and impossible to end. Only assignments on active patterns now block; rows on inactive or missing patterns are ignored, matching every other reader. The assign dialog also lists the employee’s existing assignments, auto-ticks “End previous overlapping assignment” when the start date collides, and ASSIGNMENT_OVERLAP now names the real cause instead of talking about shifts.
• Orphan assignments for nonexistent employees: the employee check in POST …/assign only ran in multi-company installs — single-company setups accepted any employee id and wrote rows that could never resolve. The endpoint now always verifies the employee exists (EMPLOYEE_NOT_FOUND).

Changed

• Rotation cycles up to 8 weeks: allowed cycleWeeks widened from 1–4 to 1–8 so non-week-aligned rhythms are representable (e.g. 4-on/2-off needs a 6-week cycle). A stored [1,2,3,4] — the old default that settings saves auto-persisted — now widens to the full range; explicitly narrowed lists are still honoured.

Fixed

• API hardening: stricter request validation and error paths.
• Localization fixes.

Changed

• Atlas v3.5.14 verification pass: expanded contract coverage; store screenshot URLs corrected.

Fixed

• Shifts can be deleted from the edit dialog: opening a filled roster cell showed only “Save changes / Cancel” — the “Cancel shift” action that existed on the assignments table row is now also available inside the edit dialog (danger secondary action), so a manually entered shift can be removed from either surface.
• Access page could not remove people: saving the app policy re-validated stored allowlist entries — a user or group deleted in Nextcloud meanwhile made every save fail, so removals never persisted and leaving the page always warned about unsaved changes. Stored entries that no longer resolve are now pruned (and reported back) while newly added entries are still strictly validated. Removing an entry also announces that “Save app policy” is still needed.
• Roster error rows get a working Retry and an empty/failed roster grid no longer leaves a dead keyboard tab stop.
• Pattern days corrupted on save: the web client posts urlencoded bodies, so an unchecked day arrived as the string "false" and PHP's (bool) cast stored every day as working. Strict boolean parsing (ApiMutationParams::boolValue*) now honours true/false/1/0/on/off/yes/no on every affected endpoint — patterns reopen with exactly the days you marked.
• Duty & team settings flipped everything ON: the same "false" → true coercion is fixed for all toggles; ambiguous values now fail with INVALID_BOOLEAN instead of silently turning features on.
• Patterns can now be deleted: new danger Delete action with confirmation; patterns are soft-deactivated (assignments keep their history) and no longer clutter the list.
• Delete could still be refused after settings changes: deactivation no longer re-validates the stored cycle_weeks against the current allowed list and no longer requires the rotation feature flag — a pattern can always be deactivated. Unchanged stored values are only validated when actually changed.
• Suggest fill filled nothing: the preview no longer inherits the “Add assignment” form’s location as a hidden filter, and location-filter drops are counted and shown (“Skipped (location filter): n”) instead of a misleading “nothing to fill”.
• Open shifts could not be deleted: OpenShiftService::discardOpen() existed internally but no route exposed it — a posted open shift stayed forever. The roster now lists posted open shifts with a Delete action (DELETE /api/open-shifts/{id}); shifts with a pending or approved claim refuse deletion.
• Location qualification requirements were permanent: requireForLocation had no inverse — DELETE /api/locations/{id}/qualifications/{qualificationId} (+ POST detach alias) removes a requirement, and each qualification chip now lists its required locations with a Remove action.
• Swap requests could not be withdrawn: the requester had no way to take back a pending swap. New POST /api/my/swaps/{id}/withdraw (requester-only, race-safe) shows “Withdraw swap request” on My roster, with companion parity via /api/mobile/my/swaps + /api/mobile/swaps/{id}/withdraw.
• Shift template active flag silently reset: ShiftTemplateService::update cast the flag via (int), turning "true" into 0 — now parsed strictly like every other boolean field.
• Session CSRF guard: the web client no longer sends OCS-APIRequest (a header that tells Nextcloud to skip its CSRF check), and a new SessionCsrfMiddleware re-validates the request token server-side for every session-authenticated mutation regardless of that header — a forged or malformed request can no longer opt out by claiming to be an API client.
• Release tarball shipped dev artifacts: make release packed vendor/ (all dev-deps — the app has zero runtime composer requirements), docs/atlas evidence files, phpunit.xml, playwright.config.js, and a stray .auth/ dir — ~27 MB of non-product content. The excludes now drop them and verify-release fails if they return; the archive is ~3 MB of product only.
• Small-screen accessibility: the roster scroller is keyboard-focusable exactly while it actually scrolls (axe scrollable-region-focusable), and the access-state panel wraps instead of overflowing at 320 px.

Tests

• Unit: strict-bool parser, urlencoded filterPatch/weekDays normalisation, stale-allowlist pruning on policy save; JS source contracts for the modal delete parity + removal cue; Playwright spec covering the pattern round-trip + delete, settings persistence, modal delete parity, and the suggest request contract.

Fixed

• Conflict thresholds callout: “Apply to open periods” is shown only when open periods still use older caps (no grey dead button after Save when already in sync). Soft/hard HTML max aligned with server clamps.
• Roster copy: “Apply copy” stays hidden until Preview reports something to copy (same omit-over-disable pattern).
• Conflict rematerialize: After threshold save/apply, budget-dirty open periods rematerialize so stale hard caps do not linger; concurrent sibling writers get clear already-decided handling where applicable.

Changed

• App Store / GitHub release cut from the conflict-threshold source on master (correct v0.3.3 tag); packaging and App Store signature refreshed for upload.

Added

• Conflict thresholds → Apply to open periods: saving live caps no longer leaves planners stuck; app admins can re-freeze the current policy onto every open period in one click (published/closed stay unchanged; audit CONFLICT_THRESHOLDS_REAPPLIED).
• Settings callout explains the create-time freeze; live ≈ hours hints next to minute fields; period/week dual-use of soft/hard caps is labelled plainly.
• Dashboard planning status shows a freeze hint with a deep link when hard period/week hour caps are blocking publish.

Tests

• Unit apply/status + settings/dashboard template contracts; integrity mutation asserts; Playwright axe on /settings/conflicts.

Fixed

• Settings → Mobile license: tall license/seats page could not scroll to the bottom. #app-content is now the vertical scrollport; unpaired overflow-x: clip on the shell (CSS Overflow L3 y-axis clip) is removed so the seats table stays reachable.

Changed

• Keep Nextcloud 32–35 (max-version 35).

Added — Roster Self-Service GA (DC-AZC-ROSTER-GA-1)

• N-week rotation patterns (1–4): CRUD, per-employee assign, forward-only anchors, suggest-fill preview/confirm with period mutex
• Soll facade (EffectiveTargetHoursFacade v1) for ArbeitszeitCheck opt-in; sealed months ignore live drift
• Peer Team week (default off), bilateral swap path sharing planner CAS apply, preferences (Früh/Spät bands), hard blackouts
• Today board (“Wer ist wo?”) planner-only; Dienst & Team settings section (Bachus first-paint toggles)
• Push quiet hours with bounded queue (200/user, 24h TTL); legacy companies default off, new companies on
• ICS Mobile create/copy/rotate + global IP spray rate limit; Duty Mobile Bachus tabs Heute · Woche · Team
• Security: IDOR on peer/Today/blackouts/swaps; no preference free-text; ICS token never logged

Security / architecture

• Swap/bilateral apply is a single Duty DB transaction + assignment version CAS
• Suggest confirm all-or-nothing under dc_period_locks
• Quiet push queue bounded (Zeus FM-QH-01)
• Cross-app: read-only facade only — no shared transactions / no AZC SQL on dc_*

Fixed

• Translations: roster/catalog window status lines and “(opens in a new tab)” are translated in every shipped locale (de/fr/es/da/nl/it/pl/sv/nb/pt_BR), not left as English identity leftovers. Placeholders {from}, {to}, and {total} stay in the same order as the msgid.
• l10n glossary alignment: corrected wrong translations and standardised button labels across all shipped locales to match the cross-app glossary.

Changed

• Help, Support & Us / Get the App: WCAG 2.1 AA hardening and translated footer copy for all website footer locales.
• CI: collapsed GitHub Actions to a single PHP syntax-only smoke job; full test suites stay local.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Tests

• l10n catalog integrity PHPUnit + JS contract; CI runs check-l10n-placeholders.php (including pt_BR and regional variants) and run-l10n-catalog-mutations.php.

Fixed

• Language vs locale: DutyCheck now honours Nextcloud Language for UI text (lang, relative time, weekday names) and Locale for date order and first day of week. English UI with a Dutch locale no longer presents the interface in Dutch. The header shows Start of week from Locale, named in Language.
• Translations: planning “period” is no longer translated as menstruation (Dutch menstruatie, Swedish mens, French règles, Italian ciclo). Empty-state copy uses the time-range sense in nl/fr/it/sv/pl. Work “shift” is no longer translated as displacement/change (Dutch verschuiving, Italian spostamento, French changement, Danish Kravskifte, Spanish turno de reclamo).
• Speed: Periods, Dashboard pulse, Absences, and Roster GET no longer load a full conflict recompute for a button click. GET publish-readiness and roster reads use persisted conflicts; overlap checks group by employee; absence collisions are batched. Writes (assign/publish/close) still refresh.

Changed

• Version lockstep 0.1.42. Nextcloud max-version remains 34 (current stable 34.0.3).

Added

• Brazilian Portuguese (pt_BR): UI catalog (l10n/pt_BR.json / pt_BR.js).

Fixed

• Activity provider (NC 34): unknown / foreign activity events throw OCP\Activity\Exceptions\UnknownActivityException instead of \InvalidArgumentException, matching the Activity API contract.

Changed

• l10n: locale catalogs refreshed for parity; tooling accepts pt_BR.
• Nextcloud: max-version remains 34 (current stable 34.0.3).

Fixed

• ArbeitszeitCheck integration “Sync now”: per-admin rate-limiter config keys no longer exceed Nextcloud’s 64-character oc_appconfig.configkey limit (full SHA-256 digest was producing 89-character keys and HTTP 400). Manual sync works again; background reconcile was unaffected.

Changed

• German locales (de / de_DE): formal Sie-address and clearer duty-planning, period, conflict, and license copy.

Accessibility / UX

• Setup progress WCAG fix (NC34). Done-step checkmarks no longer paint --color-primary-element-text (white) on --color-success. On Nextcloud 34, --color-success is a pale surface (#D8F3DA) — white-on-success measured ~1.18:1 (fails 1.4.11). Done status now uses --color-success-text on the success surface with an --color-element-success ring (same contract as status badges).
• One next step. Setup checklist collapses done rows, highlights only the current gate, and shows a single primary CTA. Misleading “each item links” copy removed. Quick start is suppressed while setup gates remain so onboarding is not duplicated.
• E2E fixture proves done-status contrast ≥ 4.5:1 under live theme tokens; JS + CSS contract tests lock the ink token.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable; full cleanup runs only on app removal.

Fixed

• Employee and location saves no longer hit the wrong URL or silently empty the list. js/common/api.js now resolves every app-relative path through OC.generateUrl for GET, POST, PUT, and DELETE (mutations previously skipped this and could 404 on hosts that require /index.php/). After a successful save, the Employees and Locations pages reload the catalog from the server instead of trusting a stale empty data array.
• Updates use POST as well as PUT (/api/employees/{id}, /api/locations/{id}) so reverse proxies that block PUT still persist edits.
• Incomplete database schema returns SCHEMA_NOT_READY (503) with a clear message instead of a generic failure when dc_employees (or other tables) are missing.
• German translations for the dashboard “Setup progress” checklist and related setup strings (were still showing English on de / de_DE locales).

Fixed

• Install and upgrade path hardened. appinfo/info.xml now declares MySQL/PostgreSQL under <dependencies> (required by MigrationService for correct schema checks), and EnsureDutyCheckSchema runs on install and post-migration to recreate any missing tables and fail loudly in occ upgrade logs instead of leaving a half-installed app with no UI feedback. Schema repair uses OC\DB\Connection for MigrationService, matching core occ upgrade.
• Dashboard setup progress. Planners see a persistent “Setup progress” checklist (schema, employees, locations, open period) with direct links until planning is possible; incomplete database setup shows a critical alert and an audible error message.
• Integration and policy errors use targeted messages in messaging.js (peer app missing/disabled/too old, sync throttled, legacy absences, access list required) instead of a generic “Something went wrong”.
• Settings integration load failures now surface via the shared error handler (toast + live region), not only a silent banner.
• Navigation boot failures are logged to nextcloud.log instead of being swallowed in Application::boot().

Added

• tests/Integration/UpgradeRepairIntegrationTest.php and EnsureDutyCheckSchemaTest to guard the production upgrade container path.

Fixed

• Roster "Create assignment" form layout. On the tablet/desktop grid the start- and end-time fields were placed in columns 2–3, leaving a gap in the first column and pushing the break field out of alignment. Start now sits in column 1 and end in column 2, so the day/time row lines up cleanly with the rest of the form.

Changed

• Mobile-first responsive layout. The stylesheet now builds up from a small-screen base (min-width: 480px / 768px breakpoints) instead of patching a desktop layout downward. Shell, cards, page header, filter and form grids reflow cleanly from phone to desktop, and overflow-x: clip prevents the stray horizontal scrollbar on narrow viewports.
• Tables collapse to cards on small screens. Data tables render as stacked, labelled cards below the tablet breakpoint (row headers and data-cell labels) and switch back to a normal table on wider screens, keeping rosters and lists readable on phones (WCAG 2.1 AA reflow).
• Tighter page header with a smaller icon and a dedicated actions area so primary actions stay reachable on mobile.

Security

• Hardened CI workflow and refreshed the Composer lock file to pull in the patched Symfony release (CVE fix), keeping bundled dependencies current.

Fixed

• Mutations no longer fail with an opaque REQUEST_FAILED after the CSRF token rotates. The shared API client (js/common/api.js) now transparently refreshes the request token from /csrftoken and retries a write once on 412 — the same recovery @nextcloud/axios performs for the rest of the Nextcloud frontend. This fixes "Add employee" (and every other create/update) failing on long-lived or multi-tab sessions, where the failure left no entry in nextcloud.log (CSRF rejections are handled in middleware and are never logged). Retrying is safe because a 412 is rejected before any database write occurs.
• Clear, localized error messages (js/common/messaging.js): expired tokens/sessions now tell the user to reload, and internal codes (REQUEST_FAILED, INTERNAL_ERROR, …) are never shown raw. German translations added.
• Editing or deactivating an employee whose linked Nextcloud account was deleted no longer fails. RosterService::updateEmployee only re-validates the linked account when it actually changes; an unchanged, now-missing link stays manageable so the record is never frozen. A new (or changed) link to a missing account is still rejected.

Changed

• App Store listing copy refreshed for broader appeal (appinfo/info.xml: summary + long description, EN + DE).

Added

• Searchable IANA timezone picker on the locations page: js/common/timezone-picker.js with keyboard navigation, live filtering, and accessible listbox semantics; backed by TimezoneCatalog and a new read-only catalog API (CatalogApiController).
• OCA\DutyCheck\Repair\UninstallDropTables wired in appinfo/info.xml so disabling the app drops all dutycheck tables, migration rows, and app config.

Changed

• TimezoneCatalog: expanded IANA coverage and unit tests (TimezoneCatalogTest); roster/location flows use the shared picker instead of a plain text field.
• Locations UI: timezone field uses the new picker component; styling in css/app.css for the combobox pattern (WCAG-friendly focus and contrast).

Bumped

• Nextcloud max-version: 33 (latest stable major).

Fixed

• App Store info.xml: use https:// for author homepage, website, and donation URL (matches ProjectCheck; store schema requires https://.+).