Commit Graph
44 Commits
Author SHA1 Message Date
Karl Ludwig Weise d59f039358 Display badge on current passkey 2026-07-24 15:54:03 +02:00
Karl Ludwig Weise db48155a7d Throttle now applies to all tenants across a server 2026-07-02 18:32:01 +02:00
Karl Ludwig Weise c322b557c0 Merge remote-tracking branch 'origin/main' into fix/headers 2026-04-20 09:50:21 +02:00
Karl Ludwig Weise d04d87ed2e Fix check 2026-04-20 09:37:22 +02:00
Karl Ludwig Weise cd33d707ee Merge remote-tracking branch 'origin/main' into fix/headers 2026-04-07 18:34:43 +02:00
Karl Ludwig Weise 4f73625c97 Changed object csp object-src to self 2026-04-07 14:43:53 +02:00
Karl Ludwig Weise 0bd45cf342 Merge remote-tracking branch 'origin/main' into secure-staff-public-keys 2026-03-16 09:27:17 +01:00
Karl Ludwig Weise c1ee527818 wip 2026-03-12 17:43:27 +01:00
Hendrik Belitz 17d4846b8d Bootstrap tokens for new clients. Use jti on client tokens.
Secure my-appointments with token.
2026-03-11 13:28:07 +01:00
HendrikandGitHub bd6c10e160 224 remove sensitive information from logs (#225)
* Logging adapted

* Fix log mocks

* Lint fixes
2026-03-10 19:08:03 +01:00
HendrikandGitHub 166373aa85 fixed error and failing unit tests (#203) 2026-02-26 17:29:49 +01:00
Karl Ludwig Weise bf9d642f0c Added notification front-end 2026-01-27 22:10:13 +01:00
Karl Ludwig Weise cfff6f786c Fix expired access token: Do not check access token for public routes 2026-01-26 20:42:51 +01:00
Karl Ludwig Weise 85a0fed42b Fix check 2026-01-21 22:04:17 +01:00
fb3b880204 142 provide logic and apis to use more than one passkey with a staff member (#163)
* Basic implementation

* Syntax fixes

* Implemented PRF for passkey administration. Updated docs, renamed confusing endpoints.

* Update src/routes/api/auth/passkeys/[passkeyId]/crypto/+server.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Removed unused param

* Merge fixes, formatting fixes, database migrations

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-13 18:35:42 +01:00
8c0343b1ec Feat/email renderer (#172)
* Added poc of new email renderer

* Completed email renderer poc for appointment confirmation

* Changed phone description in add-personal-data-form

* Added used email types to new email system

* Switched email templates to the new template engine.

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2026-01-12 10:03:22 +01:00
HendrikandGitHub 1959115d70 127 add checkpermission everywhere where needed (#140)
* Simplified locals.user
Checked routes for accessibilty

* Fixed tests

* Fixed import errors

* Fixed invite test
2025-12-16 11:25:19 +01:00
316d7ef25b Feat/book appointment (#121)
* Adding book appointment workflow -wip

* Load channels

* Added channel and agent selection

* Provide optional filter criteria for agents and channels in schedule endpoint.

Return agent info for free schedule slots.

* Select slot

* Added personal data form

* Added login and register step

* Empty PIN input when crypto fails

* Added summary and complete steps

* Format errors in otp component

* Format error in otp component

* Store staff keypairs for appointment encryption

* storeStaffKeyPair during passkey setup

* Fix lint

* Allow access to tenants for tenant admins

* Removed centralised route-based authorization.

* Use setupState from back-end

* First tenant admin is ACCESS_GRANTED.

* load local argon2 directly in central html file

* Make sure cookie is deleted on logout

* Allow WASM execution

* Staff key is base64 encoded, not hex encoded

* Fix proceeding to summary

* Fix TunnelId. Fix Appointment Date. Fix missing AgentId for Tunnel Creation call.

* Fix book appoint flow for new users

* Fix design issues

* Show only slots that have not passed

* Reimplemented ShamirsSecretSharing with Laplacian Interpolation

* Check for existing users before creating new client tunnels. Corrected base64 decoding of challenge.

* Properly deal with existing client errors (422)

* Use new shamir implementation for shard construction and key reconstruction.

* Fix lint and check

* Fix csp header test

* Fixed tests

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2025-11-13 14:55:11 +01:00
23941e7a5e Feat/staff (#110)
* Added basic staff functions -wip

* Fix: Use proper route for staff member creation

* Fixed errors in confirm, invite and register routes.

* Also return invited staff members when getting staff members

* Updated error handling

* Allow global admin to add other global admins

* Sort staff members by name

* Added dummy implementation of granting access to staff members

* Render tenant logo, if set

* Fix delete

* Make invited but not confirmed user entries deletable.

* Added staff onboarding with passkey -wip

* Fix delete route

* Fix passkey setup flow for staff

* Fix lint

* Fix lint

* Fix some unit tests

* Updated docs

* Refactored staff-service, fixed tests

* Setup state db migrations

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
Co-authored-by: Hendrik Belitz <hendrik@innovation-through-understanding.de>
2025-10-24 13:09:52 +02:00
604e7fdddd Added public tenant api (#115)
* Added public tenant api

* Moved public channels to their own endpoint and creator public api path

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-10-21 18:22:09 +02:00
4572352341 Client and staff access to appointments and schedules (#90)
* Web workers for crypto functions. Crypto key storage in db.

* First prototype appointment service and api

* Basic flows für clients.

* Staff crypto

* Browser crypto functions

* Get appointments from a date range

* API docs

* Schedule API, fixed schedule errors

* Tests and bugfixes

* Formatting

* enhanced and unified Browser-Crypto-Utilities
trying to create a new tunnel when tenant has no users now results in an error.
user creation now has a confirmation state.

* Staff API, getting and updating tunnel data.

* Tests for staff endpoints
Fixed for confirmationState
Fixed tests

* Moved logic to staff service

* Moved logic to appoointment service

* calendar route for staff members. schedule route for clients.

* Fix client access to certain routes

* Update src/routes/api/tenants/[id]/staff/__tests__/staff-api.test.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/routes/api/tenants/[id]/staff/[staffId]/public-key/__tests__/public-key.test.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/routes/api/tenants/[id]/appointments/tunnels/add-staff-key-shares/+server.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Security fixes for staff-crypto key retrieval.

* LInting errors

* DB Migrations

* Removed isEncrypted property

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-10-05 15:49:11 +02:00
Karl Ludwig WeiseandGitHub 838e724351 Feat/agents (#83) 2025-09-25 17:10:44 +02:00
HendrikandGitHub 629351d6fa Scheduling api (#68)
* Additions for agent absencies and appointments. Schedule determination.

* Scheduling tests. Agent and appointment tests.

* Absence and Agent APIs

* Linting

* Appointment API (staffing side)

* LInting and fixed tests

* Centralised permission check

* Permission refactorings, session bugfixes

* Test fixes (first part)

* Test fixes

* Fixed type

* Linting fixes

* Fixed tests

* Formatting

* Data schema changes

* Adaptions to last merges and changes

* Incorporated changes as discussed in weekly

* Test fix
2025-09-15 16:22:41 +02:00
fd8990e258 Properly detect locale (#80)
* Properly detect locale

* Fix test

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-09-12 16:28:58 +02:00
Karl Ludwig WeiseandGitHub 9e6dfe7b5e Feat/tenants (#74) 2025-09-12 16:20:02 +02:00
HendrikandGitHub 94e20ca9aa BUG fix. Refresh route should properly refresh the token and be calla… (#69)
* BUG fix. Refresh route should properly refresh the token and be callable when cookie token is no longer valid.

* Use old session id from old token for refresh. Refresh offset set to ten minutes.
2025-09-08 11:36:11 +02:00
bf610cac2b Change prettier settings (#65)
Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-09-01 17:47:46 +02:00
6fd217b4e3 Feat/dashboard setup (#63)
* Added dashboard screens

* Fix lint

* Fix lint

* Fixed fetching user data on reload

---------

Co-authored-by: Karl Ludwig Weise <ludwig@ludwigweise.de>
2025-09-01 16:26:27 +02:00
Hendrik Belitz 8796782d1d Fix session expiration and tests 2025-09-01 15:47:51 +02:00
Hendrik Belitz 7f71d5d83f Fixed challenge string (needs to be base64url)
Fixed logout (needs credentials)
Fixed passkey counter (does not neccesarly work for browser/os based passkeys)
2025-08-27 10:16:11 +02:00
Karl Ludwig Weise 4c88574bbc Adding setup with passkey -wip 2025-08-22 15:55:53 +02:00
Hendrik Belitz 91fb1fa115 Determine correct url for confirmation pages in mail templates. 2025-08-22 13:49:22 +02:00
Karl Ludwig Weise 5f4ca7e9c9 Added first thoughts on fe architecture and admin-setup 2025-08-01 17:10:16 +02:00
Hendrik Belitz 3e1a5fa9c6 Merge branch 'main' of github.com:open-reception/appointment-booking-software into 53-tenant-data-backend 2025-07-29 11:50:24 +02:00
Karl Ludwig Weise 58ec345bbe Fix login check 2025-07-28 21:30:37 +02:00
Karl Ludwig Weise 97dbc1a2ab Move i18n to lib 2025-07-28 21:30:37 +02:00
Karl Ludwig Weise a033229181 Move handle into its own file 2025-07-28 21:30:37 +02:00
Hendrik Belitz 65f001ce7b 53 fix session revocation 2025-07-25 11:35:30 +02:00
Hendrik Belitz 253882ab76 53 - Invite routes, bugfixes 2025-07-25 10:55:02 +02:00
Hendrik Belitz 58498e77c6 Clean up auth 2025-07-24 17:27:46 +02:00
Hendrik Belitz 62e1ae9ce5 #53 Auth handler updates 2025-07-16 15:58:22 +02:00
Hendrik Belitz ddc3f17a0c #53 code stylings 2025-07-16 15:27:54 +02:00
Hendrik Belitz a1d4345410 #53 session handling 2025-07-16 15:27:03 +02:00
Hendrik Belitz 532d0b85c9 Refactored server hooks 2025-07-06 15:43:56 +02:00