- Neue CalDAV-Route mit PROPFIND und GET-Endpoints
- ICS-Format-Generator für Buchungsdaten
- Token-basierte Authentifizierung für CalDAV-Zugriff
- Admin-Interface mit CalDAV-Link-Generator
- Schritt-für-Schritt-Anleitung für Kalender-Apps
- 24h-Token-Ablaufzeit für Sicherheit
- Unterstützung für Outlook, Google Calendar, Apple Calendar, Thunderbird
Fixes: Admin kann jetzt Terminkalender in externen Apps abonnieren
- Fix getBookingByToken to only accept booking_access tokens
- Add sweepExpiredRescheduleProposals with admin notifications
- Return isExpired flag instead of throwing errors for expired proposals
- Fix email template to use actual token expiry time
- Remove duplicate admin emails in acceptReschedule
- Add one-click accept/decline support via URL parameters
- Change confirmation emails from CC to BCC for admin notifications
- Change cancellation emails from CC to BCC for admin notifications
- Improve privacy: customers no longer see admin email address
- Admin still receives copies of all customer communications
- Maintain GDPR compliance and data protection
- Add frame-src directive to CSP for OpenStreetMap.org
- Fix Impressum map display issue in production
- Allow embedding of OpenStreetMap iframes while maintaining security
- Update Caddyfile CSP configuration
- Add better error messages for invalid/expired booking tokens
- Replace generic 'Internal server error' with user-friendly explanations
- List possible reasons why booking links might not work
- Add clear call-to-action for new bookings
- Improve user experience with helpful guidance
- Add confirmation modal for booking cancellations
- Implement proper error handling and success messages
- Fix live updates for booking status changes
- Add manual refetch to ensure immediate UI updates
- Auto-delete past availability slots on list access
- Add manual cleanup function for past slots
- Improve user experience with instant feedback
- Add manual refetch calls after slot creation/deletion
- Ensure availability list updates immediately after changes
- Fix issue where slots didn't appear in list after adding
- Improve user experience with real-time updates
- Ensure consistent environment variable handling between dev and prod
- Explicitly disable duplicate check bypass in production environment
- Maintain security by preventing multiple bookings per email in production
- Behebe Port-Konfiguration für interne RPC-Verbindungen (5173 -> 3000)
- Verbessere oRPC-Fehlerbehandlung: ursprüngliche Fehlermeldungen werden beibehalten
- Erweitere Frontend-Fehlerbehandlung für bessere oRPC-Integration
- Deaktiviere Duplikat-Prüfung in Development-Modus (NODE_ENV=development)
- Lokale Entwicklung ermöglicht mehrere Buchungen pro E-Mail-Adresse
- Produktion behält Duplikat-Schutz bei
- Changed from rpcApp.use to rpcApp.all for better route handling
- Added proper error handling with try-catch
- Return 404 for unmatched routes instead of calling next()
- Return 500 for internal server errors
- Improves RPC endpoint reliability and debugging
- Added table-fixed layout for consistent column widths
- Set specific column widths: Behandlung (2/5), Kategorie (1/6), Dauer (1/12), Preis (1/12), Aktionen (1/6)
- Truncate long descriptions to 50 characters with tooltip
- Added truncate class to prevent text overflow
- Ensures all columns are always visible without horizontal scrolling
- Changed overflow-hidden to overflow-x-auto
- Fixes missing Edit/Delete buttons in treatments table
- Allows horizontal scrolling when table is too wide
- Resolves CSS layout issue in production
- Changed from 'src/client/main.tsx' to 'index.html' to match actual manifest
- Fixes production asset loading
- Resolves empty page issue in production mode
- Enables Vite manifest generation for production builds
- Fixes CSS loading issues in production
- Resolves missing buttons in admin treatments page
- Ensures proper asset path resolution
- Added NODE_ENV check before serving static files from ./dist
- Prevents 'serveStatic: root path ./dist is not found' error in development
- Keeps Docker/production configuration intact
- Development mode now works with pnpm dev without build step
- Moved favicon.ico and favicon.png handlers inside stargirlnails.de block
- This prevents Caddy from trying to create SSL certificates for favicon files
- Uses 'handle' directive for path-specific routing within the domain
- Fixes 'Invalid identifiers requested' error for favicon files
- Changed 'file favicon.png' to 'try_files {path}' which is the correct Caddy syntax
- Updated root path to /app/public for consistency
- This fixes the 'unrecognized directive: file' error in Caddy
- Added COPY --from=base /app/public ./public to Dockerfile
- This ensures all public assets (favicon.png, AGB.pdf, assets/) are available in production
- Fixes missing public files in the production container
- Public directory contains favicon.png, AGB.pdf, and logo assets
- Added favicon.ico redirect to favicon.png (301 redirect)
- Added favicon.png serving from /app/dist directory
- This fixes favicon loading issues in browsers
- Both favicon.ico and favicon.png requests are now handled correctly
- Removed rate_limit directive which is not supported in Caddy
- Caddyfile now uses only valid Caddy directives
- This fixes the configuration error that was preventing Caddy from starting
- Replaced nginx and certbot services with caddy in docker-compose-prod.yml
- Added Caddyfile configuration with automatic SSL and security headers
- Created setup-caddy.sh script for easy deployment
- Caddy automatically handles Let's Encrypt certificates without manual setup
- Much simpler SSL management compared to nginx/certbot combination
- Created check-ssl-simple.sh that uses direct Docker commands instead of docker-compose
- Uses alpine:latest container directly with volume mount
- Avoids Certbot communication issues that cause hanging
- Provides clean SSL certificate inspection without external dependencies
- Changed from alpine to certbot service which is defined in docker-compose-prod.yml
- This fixes the 'no such service: alpine' error
- Script now uses the existing certbot container to check SSL certificates
- Created check-ssl-direct.sh that checks SSL certificates without using Certbot
- Uses Alpine container to directly inspect the certbot-certs volume
- Avoids hanging issues with Certbot communication
- Can automatically enable HTTPS if certificates are found
- Created setup-simple.sh that starts the application with HTTP-only
- Avoids SSL certificate checking that was causing hangs
- Provides a working baseline before SSL setup
- Users can manually configure SSL later if needed
- Created check-ssl-permissions.sh to diagnose SSL certificate access issues
- Script checks certificate files, permissions, and ownership
- Attempts to repair permissions if needed
- This helps identify if SSL setup issues are permission-related
- Added 30-second timeout to certificate check to prevent hanging
- Added fallback to HTTP-only configuration if SSL setup fails
- Script now continues even if certificate verification fails
- This prevents the script from hanging indefinitely
- Added check for existing SSL certificates before attempting to create new ones
- Restore original HTTPS nginx.conf after certificate verification
- This prevents the script from hanging when certificates already exist
- Created nginx-http-only.conf for initial startup without SSL
- Added setup-ssl-improved.sh script that:
- Starts app first, then HTTP-only Nginx
- Creates SSL certificates via Certbot
- Switches to HTTPS configuration after certificate creation
- This prevents Nginx from failing on missing SSL certificates during initial startup
- Install su-exec in Dockerfile for user switching
- Modified start.sh to create directories as root, then change ownership
- Container starts as root but switches to nextjs user for app execution
- This prevents permission denied errors when creating .storage directories
- Changed from bind mount to named volume for .storage
- Added start.sh script that creates required directories before starting the app
- This prevents ENOENT errors when initializing admin user
- Automatische Generierung eines Google Forms aus der Test-Checkliste
- ~180 Checkbox-Items über 14 Sections
- Testergebnis-Bereich mit Fehlerberichten und Gesamtbewertung
- Kein API-Key erforderlich - läuft direkt im Google Account
- Schritt-für-Schritt-Anleitung im Code-Kommentar
- Exportierbar nach Google Sheets
- Mehrfach verwendbar für verschiedene Test-Runden
- 16 Hauptkategorien mit >150 Testfällen
- Alle Status-Typen abgedeckt (pending/confirmed/cancelled/completed)
- E-Mail-Integration und ICS-Dateien
- Stornierungslogik und Zeitvalidierung
- UI/UX, Performance und Accessibility
- Sicherheit und Edge Cases
- Browser-Kompatibilität
- Testergebnis-Bereich für Dokumentation
- ICS-Dateianhänge in Bestätigungsmails mit Europe/Berlin Zeitzone
- Rate-Limiting: IP-basiert (5/10min) und E-Mail-basiert (3/1h)
- Mehrschichtige E-Mail-Validierung mit Rapid Email Validator API
- Disposable Email Detection (blockiert Wegwerf-Adressen)
- MX Record Verification
- Domain Verification
- Typo-Erkennung mit Vorschlägen
- Zod-Schema-Validierung für Name, E-Mail und Telefonnummer
- Dokumentation für Rate-Limiting und E-Mail-Validierung
- README mit neuen Features aktualisiert
- Backlog aktualisiert
- Implement /.well-known/security.txt endpoint for security vulnerability reporting
- Add SECURITY_CONTACT environment variable support
- Include proper HTTP headers (Content-Type, Cache-Control)
- Set automatic expiration date and preferred languages
- Add comprehensive security policy information
- Update .env.example with SECURITY_CONTACT variable
- Document security.txt endpoint in README.md with usage examples
- Follow RFC 9116 standard for responsible disclosure
- Mount .storage directory from host to container for data persistence
- Update docker-compose.yml with volumes configuration
- Update README.md with volume documentation
- Ensure bookings and settings persist across container restarts
- Update .env.example with map coordinates (ADDRESS_LATITUDE/LONGITUDE)
- Update ADDRESS_STREET to Liebigstr. 15 and postal code to 24145
- Document GPS coordinates for interactive map feature in legal page
- Add OpenStreetMap iframe to legal page showing business location
- Support ADDRESS_LATITUDE and ADDRESS_LONGITUDE environment variables
- Generate dynamic map URLs based on configured coordinates
- Include link to full map view
- Update legal-config.ts interface to include latitude/longitude
- Document new environment variables in README.md
- Use Kiel coordinates as default (54.3233, 10.1228)
- Navigation-Link unter dem Anmelde-Formular
- Pinkes Design passend zum Stargirlnails-Branding
- Pfeil-Icon für bessere Benutzerfreundlichkeit
- Hover-Effekt mit sanfter Farbänderung
- Zentrierte Platzierung für sauberes Design
- Verbesserte Navigation und UX
- Alle Benutzer-E-Mails enthalten jetzt Links zu Impressum/Datenschutz
- Schöner blauer Info-Block mit 📋 Icon in HTML-E-Mails
- Text-Links in allen Text-Versionen der E-Mails
- Betroffen: Pending-Buchungen, Bestätigungen, Stornierungen
- Admin-E-Mails bleiben unverändert
- Konsistentes Design und Benutzerfreundlichkeit
- Direkte Navigation zu /legal für rechtliche Informationen
- Logo und Titel im Impressum-Header sind jetzt klickbar
- Klick führt zur Startseite zurück
- Visuelle Hover-Effekte (cursor-pointer, opacity-Änderung)
- Konsistentes Verhalten mit der Haupt-App
- Verbesserte Benutzerfreundlichkeit und Navigation
- Impressum-Tab zeigt jetzt korrekt rechtliche Informationen an
- Direkter HTTP-Endpoint /api/legal-config als Workaround für RPC-Problem
- Client-Komponente verwendet fetch() anstatt RPC-Calls
- Debug-Logs hinzugefügt für bessere Fehlerdiagnose
- Hinweis-Text über Umgebungsvariablen entfernt für saubereres Design
- Legal-Konfiguration funktioniert jetzt vollständig mit echten Daten
- Tab-Navigation zwischen Impressum und Datenschutz funktioniert
- Neues Impressum/Datenschutz-Tab mit konfigurierbaren rechtlichen Daten
- Konfigurationsdatei legal-config.ts für alle rechtlichen Informationen
- RPC-Endpoint legal.getConfig() für rechtliche Daten
- Schöne Tab-Navigation zwischen Impressum und Datenschutz
- Responsive Design mit Loading-States und Fehlerbehandlung
- Alle rechtlichen Daten über Umgebungsvariablen konfigurierbar
- FRONTEND_URL entfernt - nur noch DOMAIN wird verwendet
- Hilfsfunktion generateUrl() für konsistente URL-Generierung
- Code-Duplikation in bookings.ts eliminiert
- .env.example aktualisiert mit allen neuen Variablen
- README.md dokumentiert neue rechtliche Konfiguration
- DSGVO- und TMG-konforme Inhalte implementiert
- Neues Stornierungssystem mit sicheren Token-basierten Links
- Stornierungsfrist konfigurierbar über MIN_STORNO_TIMESPAN (24h Standard)
- Stornierungs-Seite mit Buchungsdetails und Ein-Klick-Stornierung
- Automatische Slot-Freigabe bei Stornierung
- Stornierungs-Link in Bestätigungs-E-Mails integriert
- Alle E-Mails enthalten jetzt Links zur Hauptseite (DOMAIN Variable)
- Schöne HTML-Buttons und Text-Links in allen E-Mail-Templates
- Vollständige Validierung: Vergangenheits-Check, Token-Ablauf, Stornierungsfrist
- Responsive Stornierungs-Seite mit Loading-States und Fehlerbehandlung
- Dokumentation in README.md aktualisiert
- Add production-ready Dockerfile with multi-stage build
- Add .dockerignore for optimized builds
- Add docker-compose.yml for easy deployment
- Add /health endpoint for container health checks
- Update README with comprehensive Docker documentation
- Include security best practices (non-root user, health checks)
- Support for both development and production deployments
- Remove outdated password hashing warnings
- Clarify that passwords are stored as Base64 hashes in .env
- Add reminder to not commit .env files
- Align documentation with actual implementation
- Add cursor-pointer and hover effects to header logo area
- Clicking on logo/title now navigates to booking tab
- Improves user experience with clear navigation hint
- Create sendEmailWithInspirationPhoto() function to handle photo attachments
- Add renderAdminBookingNotificationHTML() template for admin notifications
- Extract photo extension and content from base64 data URLs
- Generate unique filenames with customer name and timestamp
- Send separate admin notification email with photo attachment
- Include comprehensive booking details in admin email
- Add visual indicators for photo availability in email template
- Support both HTML and text versions of admin notifications
- Handle cases where no photo is uploaded gracefully
- Import treatments KV to get treatment names for admin emails
Features:
- Inspiration photos automatically attached to admin notifications
- Structured admin email with all booking details
- Photo filename includes customer name and timestamp
- Fallback handling for missing photos
- German localization for admin notifications
- Visual photo availability indicators (✅/❌)
Changes:
- email.ts: Add sendEmailWithInspirationPhoto() function
- email-templates.ts: Add renderAdminBookingNotificationHTML() template
- bookings.ts: Send admin notifications with photo attachments
elpatron