Tymeslot

Recent Commits

• Luka Breitig(16 Oct 26)

  chore: bump version to 1.26.0 Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(admin): warn at boot when an environment variable overrides a saved setting An old .env carrying ENABLE_GOOGLE_AUTH=false (or the GitHub or SSO equivalent) silently switched off a sign-in method an admin had turned on. Each variable that now overrides a different value saved on the admin settings page is logged at boot, naming the variable, the value it fixes and the saved value it hides. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(themes): keep an uploaded background saved without a background value The theme's defaults were filled into a stored background key by key. An uploaded image saved with no background value took the default preset, the background was refused and fell back to the theme's own, and the next save deleted the still-wanted upload. The defaults now stand in only for a group stored without any of its settings. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(payments): accept the return from checkout for an organiser on an unknown theme An organiser whose stored theme the catalogue no longer knows is served the default theme, and checkout sends the attendee back under the default theme's address. The return page rejected that address, so an attendee who had paid was sent home with "Payment not found". It now treats the unknown theme as the default too. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(booking): start again on the overview after a direct visit to the thank-you page "Schedule another" on a thank-you page opened directly, with no meeting type chosen, restarted on the schedule step. With no meeting type there were no days or times to pick and Back was refused, so the booker was stuck. Such a page now starts again on the overview. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  Merge branch 'env-precedence'

• Luka Breitig(16 Oct 26)

  Merge branch 'purge-real-accounts'

• Luka Breitig(16 Oct 26)

  docs: warn about old .env lines that now pin sign-in methods off Older copies of .env.example shipped ENABLE_GOOGLE_AUTH=false, ENABLE_GITHUB_AUTH=false and ENABLE_OAUTH_AUTH=false uncommented. Now that a set variable outranks the admin settings page, those lines keep the sign-in methods off. Add an upgrade note, and say in the Docker, Cloudron and README variable descriptions that a set variable locks the setting on the admin page. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(auth): point the no-accounts recovery at REGISTRATION_ENABLED when it is set When REGISTRATION_ENABLED fixes registration, the release helper's write is refused, so reopen_registration/0 now documents and specs the {:pinned, ...} error, and the startup warning for an install with no accounts left tells the operator to set the variable to true instead of naming the helper. The data retention moduledoc now describes the narrower purge. Changelog: skip Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  chore: build assets before running the e2e suite The browser tests load the bundles in priv/static, which nothing rebuilt outside a running dev server's watchers. A JavaScript or CSS change therefore went untested, and the run passed against the stale build. `mix test.e2e` now runs `assets.build` first. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(calendar): open all-day events when their chip is clicked in week view The all-day chips in the week and day views carried a hook that stopped the click's propagation, so it never reached LiveView's phx-click listener on window and the event detail modal never opened. The chips sit inside the "+N more" disclosure's <summary>, so the replacement hook cancels the default action instead: the click still bubbles, and the disclosure no longer toggles. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  Merge branch 'purge-real-accounts' into env-precedence

• Luka Breitig(16 Oct 26)

  Merge branch 'main' into env-precedence

• Luka Breitig(16 Oct 26)

  fix(settings): pin only environment values their parse recognises Several pinnable variables are parsed strictly: REGISTRATION_ENABLED and its siblings compare against "true", and the reCAPTCHA minimum scores fall back to 0.3 when Float.parse fails. A value such as 1 or abc was silently read as something the operator did not mean, and pinning it as well stopped the admin settings page from correcting it. Decide pins in Tymeslot.AppSettings.EnvPins, called from runtime.exs: a variable pins its setting only when its value is one its own parse explicitly recognises (true/false; true/1/yes or false/0/no for admin alerts, in any case for meeting payments; a number from 0.0 to 1.0 for the scores). Any other value leaves the setting as before, and a warning at boot names the variable, its value and what it accepts. Document the accepted values in .env.example, README-Docker.md and docs/ADMIN.md. Changelog: skip Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  chore(admin): translate the reworded admin alert recipient description Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(admin): stop describing the admin page as outranking variables The admin alert recipient's description said a blank field falls back to ADMIN_ALERT_EMAIL, but a set variable now fixes the field and an unset one leaves nothing to fall back to. Say instead that leaving it blank sends no alert emails. Correct the comments and docs that still described a value saved on the admin page as overriding the environment: the reCAPTCHA flags, the reCAPTCHA block in runtime.exs, the AdminLive and AppSettings moduledocs, and AppSettings.load!/0, which skips pinned keys. Changelog: skip Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  docs: describe environment variables outranking admin settings Rewrite the admin settings precedence section of docs/ADMIN.md: a set variable outranks a value saved on /admin, pinned rows are greyed out and name their variable, and removing the variable and restarting brings a stored value back. List all twelve settings that have a variable. Comment out the SSO toggles in the README-Docker.md environment example so copying it no longer pins sign-in providers off, with the same precedence note as .env.example. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(settings): warn at boot when pinned sign-in settings lock admins out An install that switched password sign-in off and SSO on from the admin page is locked out once an environment variable pins SSO off, as the old .env.example did. The admin page's lockout guard cannot catch that, so log an error at boot naming the pinned variables and how to recover. Changelog: skip Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(docker): stop pinning SSO providers off by default A Docker deployment exported ENABLE_GOOGLE_AUTH and ENABLE_GITHUB_AUTH as false when unset, which now pins both providers off and overrides the admin settings page. Pass them through only when the operator set them. .env.example no longer sets the three SSO switches by default, and explains that a variable set there outranks the admin page. Changelog: skip Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  chore(admin): translate the environment variable pin messages Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  feat(admin)!: let environment variables outrank settings saved on the admin page A setting whose environment variable holds a recognised value now keeps the variable's value, whatever the admin settings page saved. The page shows such a setting greyed out, with a note naming the variable, and refuses a change to it. The banner on the settings tabs explains the new precedence. BREAKING CHANGE: an environment variable such as REGISTRATION_ENABLED or ENABLE_GOOGLE_AUTH, when set, now takes precedence over a value saved on the admin settings page; before, the saved value won. Before upgrading, check your .env for the lines older versions of .env.example shipped uncommented: ENABLE_GOOGLE_AUTH=false, ENABLE_GITHUB_AUTH=false and ENABLE_OAUTH_AUTH=false. Left in place, they now switch those sign-in methods off; if you turned SSO on from the admin page, comment them out or no one can sign in. Unset any variable for a setting you want to manage from the admin page. Values already saved there are kept, and apply again once the variable is removed. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(group-bookings): stop a repeated yes reading as a lost seat A guest who declined and then submitted yes twice for the last seat could have the second submit told the meeting was fully booked, although the first had already given them the seat. The guest's answer is now re-read under the slot's lock, so a guest who already holds the seat is not checked for a free one. Changelog: skip Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  refactor(themes): read the preview notice ground through a token The preview notice declared its dark scrim colour inline, which the booking-theme token check rejects outside the token files. Move it into the shared defaults beside the other chrome tokens; the rendered colour is unchanged. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  Merge pull request #171 from jacotec/fix/group-guest-seats Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(themes): warn when customising a style your booking page does not use Customisations are kept per theme while the booking page renders only the chosen one, and every theme card offers "Customise Style". Changes made to another theme were saved, and shown by its Live Preview, but never reached the booking page, with nothing saying why. The customise toolbar now names the theme being edited and the one the booking page uses whenever they differ. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(themes): explain refused background uploads and state the pixel limit The image and video pickers showed LiveView's bare upload error atoms, humanised ("Too large", "Not accepted"), untranslated and without the limit that was exceeded. They now say what was wrong and what to upload instead, in the organiser's language. The image hint also names the 40 megapixel limit (16 for WebP), which an image under 20 MB can still exceed, such as a full-resolution phone photo. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(themes): accept JPEG photos with large metadata as background images The image check read only the first 2 KB of an upload, and a JPEG's dimensions sit after its metadata segments. A phone photo's EXIF block with its embedded thumbnail, or an embedded colour profile, routinely pushes them past that, so ordinary photos were refused as an invalid image format. The check now reads the whole file, which the upload size limit already bounds. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  test(themes): isolate the served uploads folder in background tests The endpoint caches the folder it serves /uploads from on its first request, so whichever test made the first request of a run decided where every later test's uploads were served from, and the WebP download test failed in about a third of seeds. The isolated upload root now drops that cache on both sides of the swap, and the image upload tests all run under it instead of one test swapping the folder inline. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(themes): stop background uploads disconnecting the customise page A finished upload was consumed twice: once from the progress callback and once from the form submit the AutoUpload hook sends, which LiveView holds until the upload completes. The consumed entry stays listed until the LiveView handles its upload channel's exit, so the second consume called into the stopped channel and crashed the LiveView after the file was saved. The organiser saw the page reconnect with no confirmation, and each upload was charged twice against the upload rate limit. Consumed entry refs are now remembered and never count as ready again. Signed-off-by: Luka Breitig <[email protected]>

• Luka Breitig(16 Oct 26)

  fix(settings): evaluate pinned settings at their pinned value in the lockout guard Changelog: skip Signed-off-by: Luka Breitig <[email protected]>