3 Commits

Include renames

Author	SHA1	Message	Date
linus	288628f20e	feat(chat): free-form GRUPPE channels with mutable participants ... - ChatChannelType.GRUPPE: created by Leitungsteam (any KC) or a Gemeinde Verantwortliche/r (own KC), mixing team users and guests/Konfis as explicit ChatParticipant rows (unlike GEMEINDE_GRUPPE, membership is not derived from Gemeinde) - POST /chat/:kcId/gruppen to create, GET participant-candidates, and POST/DELETE /chat/gruppen/:channelId/participants to manage membership (creator, LT, or Verantwortliche/r of that KC) - ChatGateway broadcasts chat:participants-changed on membership change - PushService updated for nullable ChatParticipant.userId + new guestAccountId column - SyncService now replicates ChatParticipant - Prisma migration + 14 new unit tests (75/75 passing), tsc clean - CI: add .gitea/workflows/cybedefend-scan.yml + .cybedefend project config	2026-09-12 13:25:48 +02:00
linusandClaude Sonnet 5	d48c07b0e4	feat(backend): local accounts + invites for Gemeinde Teamer ... Per the updated plan, Gemeinde Teamer are no longer Authentik-backed; they are local accounts a Gemeinde Verantwortliche/r provisions per KC. Schema: - User.authentikSub now nullable; add passwordHash + kcId (cascade from Kc) so one User model covers Authentik members and local Teamer. - new TeamerInvite model: shareable group link (email null, maxUses null) or personal invite (email pinned, single use), with expiry + revoke. - sync log now also replicates User / Membership / TeamerInvite. Auth: - TeamAuthService: bcrypt password login (POST /auth/team-login) and invite redemption (POST /auth/teamer/register) issuing a JWT signed with TEAM_JWT_SECRET, payload typ:"team". - TeamJwtStrategy (AuthGuard('team')) resolves it to the same AuthenticatedUser shape as AuthentikStrategy. - TokenVerificationService.verifyEither() also accepts team tokens (WS). - files + chat read endpoints accept 'team' tokens; Teamer see non-Konfi files and can use chat / start DMs. Teamer admin (teamer/ module, under /gemeinde/:gemeindeId): - POST/GET teamer, DELETE teamer/:userId - POST/GET teamer-invites, DELETE teamer-invites/:inviteId - LT may manage any Gemeinde; a Verantwortliche/r only their own (checked in TeamerService, since RolesGuard only scopes by kcId). Tests: TeamAuthService + TeamerService specs added (Prisma/Sync mocked), npm test green at 32. Docs (plan + backend README) updated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-09 16:50:06 +02:00
linusandClaude Sonnet 5	8ec127c0fb	feat(backend): implement phases 0-6 (auth, kc, wahl, files, chat, sync) ... Full NestJS backend for the KC-App platform: - auth: Authentik OIDC resource-server strategy + guest invite-code JWT login, plus TokenVerificationService for the WS handshake path - kc: Leitungsteam-only KC (event) creation/listing - wahl: Wahl/Workshop admin, Force-Zuteilung overrides, ZuteilungService (port of the WP plugin's kc_run_zuteilung), CSV export - files: LT-only upload with visibility tiers; list/download filtered by caller tier; StorageProvider abstraction (WebDAV/Nextcloud default, S3) - chat: Gemeinde group / DM / LT-wide / broadcast channels; REST + raw ws gateway sharing ChatService access rules - sync: append-only SyncLogEntry replication log + local<->cloud push/pull scheduler, shared-secret guarded - common: Role enum, @Roles decorator, KC-scoped RolesGuard (LT global) - serves client/web/ interim static web client under / (API under /api) Typecheck, nest build and boot test pass; needs real Postgres/Authentik/ Nextcloud to run end to end. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-09 16:23:45 +02:00