Commit Graph
238 Commits
Author SHA1 Message Date
Karl Ludwig Weise 86a3f27bf6 Fix pin throttle check 2026-01-16 13:39:42 +01:00
Karl Ludwig WeiseandGitHub a72b596084 Merge pull request #177 from open-reception/dependabot/npm_and_yarn/devalue-5.6.2
Bump devalue from 5.3.2 to 5.6.2
2026-01-16 13:01:46 +01:00
dependabot[bot]andGitHub 34f5f3c3c3 Bump devalue from 5.3.2 to 5.6.2
Bumps [devalue](https://github.com/sveltejs/devalue) from 5.3.2 to 5.6.2.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/devalue/compare/v5.3.2...v5.6.2)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.6.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-15 18:18:49 +00:00
fb3b880204 142 provide logic and apis to use more than one passkey with a staff member (#163)
* Basic implementation

* Syntax fixes

* Implemented PRF for passkey administration. Updated docs, renamed confusing endpoints.

* Update src/routes/api/auth/passkeys/[passkeyId]/crypto/+server.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Removed unused param

* Merge fixes, formatting fixes, database migrations

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-13 18:35:42 +01:00
c552945643 141 provide apis for pin reset (#162)
* Simplified locals.user
Checked routes for accessibilty

* Fixed tests

* Fixed import errors

* Fixed invite test

* PIN API implementation

* Tests for pin reset

* HOusekeeping

* Update src/routes/api/tenants/[id]/clients/pin-reset/request/+server.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Fixes for id and housekeeping

* DB migrations

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-13 18:17:42 +01:00
a6707ef081 151 bare minimum notification system (#161)
* Extension of tenant schema

* Notification service

* Notification endpoints

* Format errors

* Update src/lib/server/db/tenant-schema.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/lib/server/services/notification-service.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Explicit where clause in delete notification

* Update tenant-migrations/0008_neat_swarm.sql

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Sort notifivcations by creation date. Do not explicitly check for existance in mark as read.

* Fixed tests

* No longer store texts in notifications

* Single source of truth for notification types

* Formatting

* Fixed linting errors

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-13 18:05:32 +01:00
8c0343b1ec Feat/email renderer (#172)
* Added poc of new email renderer

* Completed email renderer poc for appointment confirmation

* Changed phone description in add-personal-data-form

* Added used email types to new email system

* Switched email templates to the new template engine.

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2026-01-12 10:03:22 +01:00
Karl Ludwig Weise efdae16249 Fixed db:drop script for local development 2026-01-07 10:28:23 +01:00
HendrikGitHubhbelcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>Copilot
b81706a8d9 Security hotfix prf (#146)
* Use PRF extension for deterministic Zero Knowledge Shards

* Webauthn validation lib

* Use attestation and validate passkeys

* Use attestation objects and cose-format keys in frontend. Added additional checks so that we don't create orphaned users when validation fails.

* Fixed type check error

* Fix PRF salt documentation to match implementation (#147)

* Initial plan

* Fix PRF salt documentation to match implementation

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

* Use dev instead of node env

* Migration fixes

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>
2026-01-02 15:08:23 +01:00
CopilotGitHubhbelcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>Hendrik Belitz
337fc2e70b Add throttling to challenge APIs for brute force protection (#145)
* Initial plan

* Add throttling implementation for challenge APIs

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

* Add tests for throttling and fix linting issues

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

* Address code review feedback - improve error handling and documentation

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

* Consolidate throttle storage to central DB per review feedback

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

* Fixed errors in challenge-throlle.

* Add throttling to frontend.

* incorporated Reviewer comments

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2026-01-02 13:14:40 +01:00
HendrikandGitHub 1959115d70 127 add checkpermission everywhere where needed (#140)
* Simplified locals.user
Checked routes for accessibilty

* Fixed tests

* Fixed import errors

* Fixed invite test
2025-12-16 11:25:19 +01:00
Hendrik Belitz 145e931f38 Do not commit audits 2025-12-14 14:39:36 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
98f6a4e9ba Bump validator from 13.15.20 to 13.15.23 (#139)
Bumps [validator](https://github.com/validatorjs/validator.js) from 13.15.20 to 13.15.23.
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/validatorjs/validator.js/compare/13.15.20...13.15.23)

---
updated-dependencies:
- dependency-name: validator
  dependency-version: 13.15.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-13 16:59:47 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
a93ee3c741 Bump nodemailer from 7.0.7 to 7.0.11 (#138)
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.7 to 7.0.11.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.7...v7.0.11)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 7.0.11
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-13 16:58:52 +01:00
Karl Ludwig WeiseandGitHub 56b7d4a9b2 Feat/calendar (#129) 2025-11-19 14:42:45 +01:00
HendrikandGitHub 6a610b96b1 When client selects an appointment that does not need to be confirmed… (#133)
* When client selects an appointment that does not need to be confirmed, send out an email. Also prepared the appointment confirmation call to send out an email.

* Removed old client table. Fixed tests.

* MIgration for removed table
2025-11-17 17:04:57 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
d5f316b181 Bump js-yaml from 4.1.0 to 4.1.1 (#135)
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-17 16:58:02 +01:00
316d7ef25b Feat/book appointment (#121)
* Adding book appointment workflow -wip

* Load channels

* Added channel and agent selection

* Provide optional filter criteria for agents and channels in schedule endpoint.

Return agent info for free schedule slots.

* Select slot

* Added personal data form

* Added login and register step

* Empty PIN input when crypto fails

* Added summary and complete steps

* Format errors in otp component

* Format error in otp component

* Store staff keypairs for appointment encryption

* storeStaffKeyPair during passkey setup

* Fix lint

* Allow access to tenants for tenant admins

* Removed centralised route-based authorization.

* Use setupState from back-end

* First tenant admin is ACCESS_GRANTED.

* load local argon2 directly in central html file

* Make sure cookie is deleted on logout

* Allow WASM execution

* Staff key is base64 encoded, not hex encoded

* Fix proceeding to summary

* Fix TunnelId. Fix Appointment Date. Fix missing AgentId for Tunnel Creation call.

* Fix book appoint flow for new users

* Fix design issues

* Show only slots that have not passed

* Reimplemented ShamirsSecretSharing with Laplacian Interpolation

* Check for existing users before creating new client tunnels. Corrected base64 decoding of challenge.

* Properly deal with existing client errors (422)

* Use new shamir implementation for shard construction and key reconstruction.

* Fix lint and check

* Fix csp header test

* Fixed tests

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2025-11-13 14:55:11 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
c4ba8d8716 Bump validator from 13.15.15 to 13.15.20 (#126)
Bumps [validator](https://github.com/validatorjs/validator.js) from 13.15.15 to 13.15.20.
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/validatorjs/validator.js/compare/13.15.15...13.15.20)

---
updated-dependencies:
- dependency-name: validator
  dependency-version: 13.15.20
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-13 09:54:31 +01:00
8f927ba5d7 Pages for managing my account set up (#131)
Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-11-12 14:30:07 +01:00
85e642fa89 Added onboarding dashboard (#128)
* Added onboarding dashboard

* Improve onboarding expericene

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-11-12 14:28:35 +01:00
HendrikandGitHub 983f6c3857 Use the normal invitation flow when inviting an initial tenant admin. (#122) 2025-10-29 16:26:49 +01:00
CopilotGitHubhbelcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
1e311bed32 Migrate to Zod 4 (#125)
* Initial plan

* Migrate to Zod 4.1.12 and update all imports

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

* Fix test UUIDs to be RFC 4122 compliant for Zod 4

Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: hbel <7416029+hbel@users.noreply.github.com>
2025-10-27 15:58:24 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
8ff2238f0f Bump vite from 6.3.5 to 6.4.1 (#116)
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.3.5 to 6.4.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 6.4.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-24 13:10:16 +02:00
23941e7a5e Feat/staff (#110)
* Added basic staff functions -wip

* Fix: Use proper route for staff member creation

* Fixed errors in confirm, invite and register routes.

* Also return invited staff members when getting staff members

* Updated error handling

* Allow global admin to add other global admins

* Sort staff members by name

* Added dummy implementation of granting access to staff members

* Render tenant logo, if set

* Fix delete

* Make invited but not confirmed user entries deletable.

* Added staff onboarding with passkey -wip

* Fix delete route

* Fix passkey setup flow for staff

* Fix lint

* Fix lint

* Fix some unit tests

* Updated docs

* Refactored staff-service, fixed tests

* Setup state db migrations

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2025-10-24 13:09:52 +02:00
12be3016f4 Validate the setup state in all relevant actions. Update it according… (#119)
* Validate the setup state in all relevant actions. Update it according to the tenant's current state.

* Update src/lib/server/db/central-schema.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Fixed schema, fixed tests, incorporated review advice

* Unused variable error fixed.

* Refactored deletion methods. Fixed partial deletion test.

* Try to delete user first before deleting key shares (to make sure the transaction fails if we cannot delete the user)

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-10-23 17:11:23 +02:00
Karl Ludwig Weise 5d60bb5885 Fix lint 2025-10-23 16:57:31 +02:00
Karl Ludwig Weise 091a078570 Added ungenerated migrations 2025-10-22 21:08:46 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
90c62718e0 Bump playwright and @playwright/test (#114)
Bumps [playwright](https://github.com/microsoft/playwright) to 1.56.1 and updates ancestor dependency [@playwright/test](https://github.com/microsoft/playwright). These dependencies need to be updated together.


Updates `playwright` from 1.53.1 to 1.56.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.53.1...v1.56.1)

Updates `@playwright/test` from 1.53.1 to 1.56.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.53.1...v1.56.1)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.56.1
  dependency-type: indirect
- dependency-name: "@playwright/test"
  dependency-version: 1.56.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-21 18:22:33 +02:00
604e7fdddd Added public tenant api (#115)
* Added public tenant api

* Moved public channels to their own endpoint and creator public api path

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-10-21 18:22:09 +02:00
9c7de2a6bd 92 check entity deletion business rules (#107)
* Added conflict checks to agent and channel deletion.

* Added missing agentId to appointment requests. Fixed tests for new error behavior.

* Removed import

* Archive agents and channels instead of deleting them.

* Update src/lib/server/services/appointment-service.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-10-21 18:14:19 +02:00
HendrikandGitHub 44cc5d0837 Merge pull request #102 from open-reception/feat/settings
Feat/settings
2025-10-16 09:26:00 +02:00
Karl Ludwig WeiseandGitHub 8d83ca0ee3 Merge pull request #109 from open-reception/108-api-should-allow-pausingunpausing-a-channel
Names in channel update schema should be an optional property
2025-10-15 18:15:49 +02:00
Hendrik Belitz 583cb56670 Names in channel update schema should be an optional property 2025-10-15 17:34:30 +02:00
Karl Ludwig Weise a56f6910e4 Update tenant store on changing settings 2025-10-15 13:35:30 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
65856b571f Bump nodemailer from 7.0.3 to 7.0.7 (#104)
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.3 to 7.0.7.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.3...v7.0.7)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 7.0.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-14 10:59:08 +02:00
Karl Ludwig WeiseandGitHub fab3c73b97 Merge pull request #105 from open-reception/dependabot/npm_and_yarn/devalue-5.3.2
Bump devalue from 5.1.1 to 5.3.2
2025-10-13 20:13:57 +02:00
Karl Ludwig Weise 74df843077 Fix lint 2025-10-13 15:32:00 +02:00
Karl Ludwig Weise b96c287c67 Merge remote-tracking branch 'origin/main' into feat/settings 2025-10-13 15:27:20 +02:00
Karl Ludwig Weise db67350f2d Move significant config to base tenant config 2025-10-13 15:25:28 +02:00
0a0703f181 Added ui to manage absences (#98)
* Added ui to manage absences

* Added test for new endpoint

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-10-13 12:58:42 +02:00
dependabot[bot]andGitHub d983eca3d8 Bump devalue from 5.1.1 to 5.3.2
Bumps [devalue](https://github.com/sveltejs/devalue) from 5.1.1 to 5.3.2.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/devalue/compare/v5.1.1...v5.3.2)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-10-13 09:15:30 +00:00
Karl Ludwig Weise ce0ac25b82 Use actual data 2025-10-12 21:11:39 +02:00
Karl Ludwig Weise 436dadc903 Merge remote-tracking branch 'origin/feat/absences' into feat/settings 2025-10-12 20:32:18 +02:00
Karl Ludwig WeiseandGitHub 6b94c2d2f6 Merge branch 'main' into feat/absences 2025-10-12 20:29:54 +02:00
Karl Ludwig Weise fd3230fece Added settings form -wip 2025-10-12 20:28:28 +02:00
Karl Ludwig Weise 6dcb32ff85 Merge remote-tracking branch 'origin/main' into feat/absences 2025-10-12 15:09:11 +02:00
6c63ac3c80 Fetch tenant (#101)
* Fetch tenant

* Update src/routes/api/tenants/[id]/+server.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/routes/api/tenants/[id]/+server.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Column rename

* Fixed tests

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-10-12 15:08:32 +02:00
d69d0a5b73 Fix editing channels with slot templates (#97)
Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-10-11 13:12:33 +02:00
Karl Ludwig Weise c4075cef71 Merge remote-tracking branch 'origin/main' into feat/absences 2025-10-10 15:37:39 +02:00