Luca b0912c7427 feat(setup): validate setup token at step 1 before advancing ...

Previously "Continue" on the token step only checked the field was
non-empty; a wrong token wasn't caught until the final submit, after the
user had filled in email + password. Add a non-burning verify:

- backend: POST /setup/verify-token constant-time compares the token
  without consuming it (createInitialAdmin still claims it atomically on
  submit), gated on no-admin-exists and rate-limited like /setup/admin.
- frontend: step-1 "Continue" calls verifyToken and only advances on a
  valid token; a wrong token shows the invalidToken error on the field,
  429 -> too-many-attempts, 409 -> redirect to login.

Adds integration tests for accept-without-burn / reject / closed-once-set.

2026-07-02 15:18:22 +02:00

..

__tests__

fix(test-infra): scope databaseBackup fs.unlink stub so it doesn't leak

2026-05-29 16:21:15 +02:00

storage

fix(gallery): serve thumbnails / photos / hero via storage abstraction (#432)

2026-05-09 20:56:20 +02:00

trackers

feat(analytics): pluggable trackers — Umami + Rybbit + Custom (#663 Phase 1)

2026-06-23 18:11:58 +02:00

workflows

feat(workflows): implement remaining stub actions (prepare_quote, prepare_gallery, reserve_date)

2026-06-27 00:49:35 +02:00

_backupPathsBoot.js

chore(migrations): renumber 108_add_backup_paths to 109 to avoid upstream collision

2026-06-01 00:31:08 +02:00

_billingRecipients.js

feat(crm): route billing docs to billing_email when set

2026-05-27 14:04:15 +02:00

_emailTemplateBoot.js

fix(crm): self-heal missing CRM email templates at boot + recover queue

2026-05-27 15:18:29 +02:00

_installFromBackupBoot.js

feat(restore): docker-logs visibility + ADMIN_CREDENTIALS.txt restore notice

2026-06-01 21:52:38 +02:00

_renderContext.js

feat(accounting): consolidate VAT/financial config into Settings → Accounting

2026-06-18 15:10:44 +02:00

_restoreSettingsBoot.js

fix(restore): default restore_allow_force=true + auto-upgrade existing installs

2026-05-31 21:35:48 +02:00

_workflowSeedBoot.js

feat(workflows): pre-event reminder picks the template GROUP on the block, type stays automatic

2026-06-24 11:26:02 +02:00

archiveService.js

fix(archives): stream-extract restore for >2 GiB + preserve original_filename via manifest (#640)

2026-06-18 22:18:54 +02:00

backgroundProcessor.js

fix(upload): auto-throttle on low-memory hosts + correct documented RAM minimum (#628)

2026-06-17 23:04:30 +02:00

backupCoverageService.js

feat(backup): coverage diagnostic — what will the next backup miss?

2026-05-29 22:20:32 +02:00

backupIntegrityService.js

feat(backup): admin endpoint to verify CRM document-artefact integrity

2026-05-29 13:00:18 +02:00

backupManifest.js

fix(backup): incremental backups against S3 + jsonb stats parsing

2026-04-28 10:52:49 +02:00

backupService.js

chore(migrations): renumber 108_add_backup_paths to 109 to avoid upstream collision

2026-06-01 00:31:08 +02:00

backupService.original.js

…

businessProfileService.js

feat(email): per-weekday business hours + manual queue flush

2026-06-02 13:00:13 +02:00

chunkedUploadService.js

Add chunked upload support for large video files up to 10GB

2025-11-28 17:53:56 +01:00

contractBlocksService.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

contractEmailTemplates.js

chore(migrations): consolidate CRM migrations 102-143 + extract email-template seeds to self-heal services

2026-05-26 18:18:15 +02:00

contractService.js

feat(workflows): wire booking document actions (prepare_invoice/contract + send_document)

2026-06-26 23:48:12 +02:00

crmEmailTemplates.js

feat(workflows): collections-handoff block after dunning exhausts

2026-06-23 12:37:50 +02:00

customerAccountsService.js

chore: migrate Docker registry + GitHub URLs to PicPeak org

2026-06-29 20:20:13 +02:00

customerHoursService.js

fix(accounting): tax-report storno totals + hours-line date on Postgres

2026-06-18 18:40:22 +02:00

databaseBackup.example.js

…

databaseBackup.js

ix(database-backup): drop bogus --single-transaction flag from pg_dump

2026-05-30 03:35:08 +02:00

dealsService.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

downloadFilenameService.js

feat(downloads): preserve original camera filenames on download (opt-in) (#493)

2026-05-14 23:11:00 +02:00

downloadZipService.js

feat(downloads): preserve original camera filenames on download (opt-in) (#493)

2026-05-14 23:11:00 +02:00

emailIntakeService.js

chore(accounting): PR #622 nits — stray artifact, dedupe requireFlag, IMAP poll backoff

2026-06-16 18:36:35 +02:00

emailProcessor.js

fix(email): resolve recipient language from the queue row's event_id, not just email_data

2026-06-25 19:50:08 +02:00

emailService.js

…

environmentService.js

chore: migrate Docker registry + GitHub URLs to PicPeak org

2026-06-29 20:20:13 +02:00

eventReminderService.js

fix(reminders): wrap is_active/is_archived wheres in formatBoolean

2026-06-29 19:39:40 +02:00

eventReminderTemplates.js

chore(migrations): consolidate CRM migrations 102-143 + extract email-template seeds to self-heal services

2026-05-26 18:18:15 +02:00

eventRenameService.js

feat: implement 4 new features with bug fixes and refactoring plan

2026-01-02 09:56:19 +01:00

eventService.js

feat(workflows): admin review gates before sends + migrate lifecycle/time triggers

2026-06-23 14:58:48 +02:00

eventTypeService.js

fix(event-types): renaming a type's slug cascades to events, quotes + reminder template

2026-06-24 13:52:42 +02:00

expenseCategoriesService.js

feat(accounting): inbound supplier-invoice capture + expense re-bill (backend)

2026-06-11 00:04:16 +02:00

expenseService.js

fix(accounting): address the-luap PR #636 review

2026-06-18 18:40:11 +02:00

expirationChecker.js

fix(workflows): ship built-ins disabled for first beta + enabled-based mutex + admin sentinel

2026-06-23 23:35:56 +02:00

externalMediaService.js

…

extractionService.js

feat(accounting): inbound supplier-invoice capture + expense re-bill (backend)

2026-06-11 00:04:16 +02:00

feedbackModeration.js

…

feedbackService.js

feat(feedback): per-guest favorite + like caps with mobile-friendly limit modal (#655)

2026-06-22 22:02:13 +02:00

fileWatcher.js

fix(import): capture photo dimensions in fileWatcher + s3AutoImporter (#447)

2026-05-11 09:58:08 +02:00

fontsService.js

feat(branding): per-family generic fallback via meta.json

2026-05-04 22:27:52 +02:00

galleryOgService.js

fix(og): rich social previews for share-token + slideshow URLs (#699)

2026-06-30 16:03:49 +02:00

galleryShortUrlService.js

feat(gallery): branded URL shortener — /s/<slug> with OG injection (#699)

2026-06-30 16:30:13 +02:00

guestRecoveryService.js

feat: guest selections with per-person identity (#292)

2026-04-11 07:48:23 +02:00

imageProcessor.js

feat(lightbox): medium-resolution preview tier (#492)

2026-05-14 22:30:39 +02:00

invoiceSchedulerService.js

fix(workflows): defer quote.accepted/declined emit until the 15-min response window locks

2026-06-28 14:30:26 +02:00

invoiceService.js

Merge pull request #680 from Luca-Timo/fix/invoice-pdf-multipage

2026-06-28 22:17:07 +02:00

ledgerService.js

fix(accounting): PR #622 blockers — CSV formula injection + IMAP double-ingest race

2026-06-16 18:21:02 +02:00

pdf-i18n.js

feat(invoices): optional sub-cent rounding reconciliation ("Rundung" row)

2026-06-28 15:53:44 +02:00

pdfService.js

feat(invoices): optional sub-cent rounding reconciliation ("Rundung" row)

2026-06-28 15:53:44 +02:00

pdfStampService.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

photoExportService.js

fix(admin/exports): Lightroom TXT export joins with comma + drops extension (#623)

2026-06-17 22:25:12 +02:00

photoProcessor.js

feat(upload): async photo processing — backend (PR-B part 1)

2026-05-02 22:56:04 +02:00

photoReplacementService.js

feat: native S3 storage backend (#328) + presigned download follow-up

2026-04-28 10:06:36 +02:00

photoResolver.js

feat: native S3 storage backend (#328) + presigned download follow-up

2026-04-28 10:06:36 +02:00

photoService.js

fix: correct storage path resolution in multiple files (#96)

2026-01-17 14:01:29 +01:00

projectService.js

fix(projects): "one customer matches" rule for deal-lineage attach

2026-06-13 13:12:58 +02:00

publicSiteService.js

feat(theme): expand color settings to 8-token CI palette + alt button

2026-05-05 16:04:43 +02:00

quoteService.js

Merge pull request #680 from Luca-Timo/fix/invoice-pdf-multipage

2026-06-28 22:17:07 +02:00

rasterizeService.js

fix(accounting): PR #622 concerns — flag-cache, customer master gate, VAT-unconfigured, helpers, page cap

2026-06-16 18:33:47 +02:00

rateLimitService.js

fix: address Shannon security assessment findings (37 vulnerabilities) (#254)

2026-03-22 12:40:01 +01:00

recaptcha.js

fix: address Shannon security assessment findings (37 vulnerabilities) (#254)

2026-03-22 12:40:01 +01:00

restoreService.js

fix(restore): set was_successful=true on the completed update

2026-06-01 22:56:02 +02:00

robotsTxtService.js

feat: add admin dark mode and SEO/robots.txt settings

2026-02-06 23:26:01 +01:00

s3AutoImporter.js

fix(import): capture photo dimensions in fileWatcher + s3AutoImporter (#447)

2026-05-11 09:58:08 +02:00

secureImageService.js

fix: prevent unnecessary image recompression and fix SQLite migration #95

2026-01-12 13:20:39 +01:00

settingsService.js

refactor: Add Photo and Settings service layers

2026-01-02 10:16:55 +01:00

setupService.js

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

shareLinkService.js

feat: draft mode, admin branding, and workflow improvements

2026-04-08 11:42:38 +02:00

taxReportService.js

fix(accounting): tax-report storno totals + hours-line date on Postgres

2026-06-18 18:40:22 +02:00

updateCheckService.js

chore: migrate Docker registry + GitHub URLs to PicPeak org

2026-06-29 20:20:13 +02:00

updateNotificationService.js

chore: migrate Docker registry + GitHub URLs to PicPeak org

2026-06-29 20:20:13 +02:00

uploadSettings.js

fix: respect allowed_file_types setting for upload validation (#203)

2026-03-01 14:36:34 +01:00

userManagementService.js

feat(admin/users): reactivate + delete actions for deactivated admin users

2026-05-29 22:49:01 +02:00

videoProcessor.js

fix(docker): install system ffmpeg on Alpine, drop broken bundled binary

2026-05-04 09:04:38 +02:00

watermarkGeneratorService.js

feat: native S3 storage backend (#328) + presigned download follow-up

2026-04-28 10:06:36 +02:00

watermarkService.js

feat: native S3 storage backend (#328) + presigned download follow-up

2026-04-28 10:06:36 +02:00

webhookDeliveryWorker.js

feat: outbound webhooks for event/photo lifecycle (#327)

2026-04-28 10:07:39 +02:00

webhookService.js

feat(workflows): route webhook node through the delivery pipeline (full Option 1)

2026-06-25 18:44:27 +02:00

whatsappProcessor.js

feat(whatsapp): admin-selectable template parameters + reorder (#647 follow-up)

2026-06-21 20:51:20 +02:00

whatsappService.js

feat(whatsapp): WhatsApp Business API notification channel (#640 part D)

2026-06-18 22:57:22 +02:00

workerManager.js

Fix issues #49 and #50: Migration errors and missing worker manager

2025-11-19 21:59:27 +00:00

xmpGenerator.js

feat: add original filename preservation and Lightroom export support

2026-01-21 16:47:13 +01:00