Client push-token acquisition is now fully configured; a real browser
session (logged-in user granting notification permission) is needed to
mint the first token. Backend delivery still needs the service-account JSON.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Only the VAPID key (Web Push certificate) is still REPLACE_ME; the push
guard now keys off vapidKey so nothing prompts until it's set.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
web/index.html loads the Firebase compat SDK and defines
window.kcGetPushToken() — inits Firebase from window.KC_FIREBASE, asks for
notification permission, registers the service worker and returns an FCM
token (or null if not configured / denied). web/firebase-messaging-sw.js
shows background notifications.
browser_web.dart exposes getPushToken() over that JS function (stub returns
null off-web). After every successful login AppState fires
_registerForPush() -> POST /api/push/register, best-effort.
Config placeholders carry the known values (projectId konfi-castle-app,
messagingSenderId 307226979593); apiKey / appId / vapidKey still say
REPLACE_ME, so push stays inert until they're filled in — the app runs
either way. flutter analyze/test/build web green.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New global push/ module mirroring mail/ and files/storage/:
- PushProvider abstraction; default LogPushProvider (no delivery, logs),
PUSH_PROVIDER=fcm switches to FcmPushProvider — Firebase Cloud Messaging
HTTP v1, authenticated by a service-account JWT exchanged for an OAuth
token (no extra dependency; jsonwebtoken does the signing). Prunes tokens
FCM reports as invalid.
- DeviceToken model (token + platform, bound to a User or GuestAccount),
migration + added to the sync log.
- POST /api/push/register + /unregister (any of the three token kinds).
- PushService.notifyChannel() resolves a channel's readable audience
(DIREKT participants / LT / Gemeinde members + guests / whole KC for
broadcast), looks up their device tokens (minus the sender), sends.
- ChatService.sendMessage() fires it best-effort after persisting.
New env: PUSH_PROVIDER, FCM_PROJECT_ID (default konfi-castle-app),
GOOGLE_APPLICATION_CREDENTIALS.
Verified against local Postgres: register a token, send a Gemeinde-group
chat message from another member -> log-push logs "would push ... to 1
device". Real FCM send needs the service-account JSON. npm test 56.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Backend:
- PATCH /api/wahl/:wahlId (isOpen) to open/close a Wahl.
- GET /api/wahl/:wahlId/teilnehmer (LT): participants with their priorities
and any existing Force-Zuteilung.
- Verified against local Postgres: PATCH toggles isOpen, teilnehmer list
returns, CSV export works. (A stale dev server on :3000 masked this at
first — real routes are fine.)
Client (client/app/):
- Wahl detail: open/close switch, participant list with a "Zuteilen"
(Force-Zuteilung) action, CSV export via a browser download
(browser.downloadText).
- files_admin_screen.dart: LT file upload — browser.pickFile() +
visibility picker -> multipart POST /api/files/:kcId; list existing
files. Reachable from KcDetailScreen.
- browser_web.dart gains pickFile()/downloadText() (native <input file> +
Blob), with throwing stubs for the VM.
- Dropped the file_picker package again (heavy transitive deps, and the
native web input is enough); disk on this box is nearly full.
flutter analyze/test/build web green; backend npm test 56.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New screens (client/app/lib/screens/):
- wahl_admin_screen.dart — per KC: list/create Wahlen; per Wahl: add
workshops, run the assignment (POST /wahl/:id/zuteilung/run), view the
result table.
- teamer_admin_screen.dart — per Gemeinde: list/create local Teamer
accounts, create group-link or per-email invites (shows the token).
- verantwortliche_register_screen.dart — enter a KC invite code
(GET /onboarding/kc/:code), pick a Gemeinde, submit
(POST /onboarding/verantwortliche); shown on the home screen to a
logged-in Authentik user who has no membership yet.
- ui.dart — shared toast / ErrorText / SectionHeader / promptText.
KcDetailScreen now links to Wahl admin and each Gemeinde row opens Teamer
admin.
Backend: widen the wahl + files LT routes to AuthGuard(['authentik','team'])
for consistency with the other LT controllers. Rebrand web/index.html +
manifest from "kc_app" to "KC-App".
Verified against local Postgres with an isLeitungsteam team token: create
KC/Gemeinde/Wahl/Workshop, run Zuteilung, create Teamer + invite, resolve
an invite code. flutter analyze/test/build web green; backend npm test 56.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Authentik accounts don't always have an email set (the test account
`hermes` doesn't). AuthentikStrategy / verifyAuthentikClaims no longer
reject those — `authentikEmail()` falls back to a stable
`<preferred_username|sub>@no-email.authentik` handle for the local User row,
and first/last name fall back to preferred_username/name.
Set AUTHENTIK_LEITUNGSTEAM_GROUP to the real group "KC-APP-LT".
Verified end to end against the live https://sso.konfi-castle.com with a
password-grant token for a KC-APP-LT member: backend accepts the RS256
token (JWKS + trailing-slash issuer), JIT-provisions the User, maps the
`groups` claim to isLeitungsteam=true, and POST /api/kc returns 201. Only
the in-browser redirect round-trip remains untested.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Plan + both READMEs updated for the Authentik Authorization-Code + PKCE
flow, the Leitungsteam admin screen, the widened LT-admin guards, the
issuer trailing-slash normalisation, and the backend now serving the
Flutter web build (SPA fallback for /v1/auth/callback). Verification
section records the local-Postgres E2E for LT admin + onboarding approval,
and notes the OIDC browser round-trip still needs a test account.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Backend:
- AuthentikStrategy / TokenVerificationService: normalise the issuer's
trailing slash and accept both `iss` spellings (Authentik's discovery
issuer and token `iss` carry a trailing slash; the JWKS URL must not
double it). Wire the real konfi-castle issuer into .env.example.
- team token path now goes through toAuthenticatedUser too, so a local
account flagged isLeitungsteam gets the synthetic global LT membership
regardless of token kind.
- LT-admin controllers (kc, gemeinde, onboarding, sync, teamer) accept
['authentik','team'] so such an account can use them. RolesGuard still
enforces the actual LT/role check.
- app.module serves the Flutter web build from client/app/build/web (SPA
fallback covers the OIDC redirect path /v1/auth/callback), falling back
to the interim client/web/ if it isn't built.
Client (client/app/):
- oidc.dart: Authorization-Code + PKCE against Authentik (discovery, S256
challenge, state, token exchange, refresh). Browser bits (sessionStorage,
redirect, URL) behind a conditional import so `flutter test` still
compiles on the VM.
- AppState handles the ?code= callback on bootstrap, stores access +
refresh, refreshes an expired token on restart.
- Login screen: "Mit Konfi-Castle-ID anmelden" button (Leitungsteam /
Verantwortliche) alongside the local Teamer password form.
- admin_screen.dart: LT-only "Verwaltung" — list/create KCs, per KC the
Gemeinden (list/create) and pending Verantwortlichen requests
(approve/reject). Verified end to end against local Postgres with an
isLeitungsteam account (create KC/Gemeinde, list + approve a request).
flutter analyze/test/build web green; backend npm test 56.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Plan + client README updated for the guest Wahl result endpoint/tab, the
WebSocket chat wiring, and the ChatGateway caller-promise fix. Section 8
now scopes the remaining Flutter work to the Authentik-dependent screens.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Backend:
- fix(chat): ChatGateway stored the per-socket caller only after the async
token check resolved, so a client that sent chat:join immediately on open
raced ahead and got 4001. The caller is now stored as a promise that the
message handlers await. Verified with a two-client send/receive E2E test
against local Postgres.
Client (client/app/):
- Wahl screen gains a "Ergebnis" tab backed by GET /wahl/guest/results
(PENDING / ASSIGNED with workshop + wish rank / UNASSIGNED).
- Chat channel view loads history over REST, then connects the /chat
WebSocket (chat_socket.dart): live chat:message stream + a compose bar
that sends chat:send. Shows the socket status.
- web_socket_channel dependency added.
flutter analyze/test/build web all green; backend npm test 56.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GET /api/wahl/guest/results (guest JWT) returns, per Wahl the guest took
part in, their assignment: status PENDING (algorithm not run yet) /
ASSIGNED (workshopName + wunschRang) / UNASSIGNED (no capacity left).
Verified both PENDING and ASSIGNED paths against local Postgres.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Root README + plan updated: local PostgreSQL 16 + first Prisma migration,
end-to-end guest-flow verification, and the started Flutter client
(client/app/, web target). Phase 7 marked in progress with the remaining
client work spelled out.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Single Flutter codebase under client/app/ with web enabled (mobile/desktop
can be added later; lib/ is platform-agnostic). Talks to the NestJS backend
via a thin REST wrapper; API_BASE is a --dart-define (defaults to the local
backend).
Screens:
- Login: Konfi/guest (invite code), local Teamer password login, Teamer
invite redemption. Token persisted in shared_preferences, restored on
start; GET /auth/me drives a role-aware home.
- Workshop-Wahl (guests): loads /wahl/guest/overview, ordered pick of up to
3 workshops, submits to /wahl/:id/teilnehmer.
- Dateien: /files/:kcId list.
- Chat: channel + message list (read-only; WS send is a follow-up).
State: AppState (ChangeNotifier) exposed via an InheritedNotifier
(AppScope) — no third-party state package. flutter analyze clean,
flutter build web --release passes, one widget smoke test.
Also: interim client/web/ HTML placeholder stays as-is (per plan it is
superseded by this Flutter web build).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Accepts any of the three token kinds and echoes back the identity behind
it: {kind:"guest", guestId, kcId, gemeindeId} for a Konfi token, or
{kind:"user", userId, email, memberships, isLeitungsteam} for an Authentik
or local Teamer token. Lets the client pick the right screens without
decoding the JWT itself.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GET /api/wahl/guest/overview (guest JWT) returns the open Wahlen for the
guest's KC, each with its workshops and the guest's own current priorities
(null if not yet submitted) — everything the client needs to render the
Wahl form without any LT-only endpoint. Verified end to end against a local
Postgres (guest login -> overview -> submit -> re-fetch).
prisma/seed-dev.js: minimal dev fixture (one KC "DEV123" + Gemeinde + open
Wahl with three workshops).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Generated with a real local PostgreSQL 16 and applied cleanly
(prisma migrate dev --name init). Covers the full current schema:
Kc, Gemeinde, Role/MembershipStatus enums, User (authentikSub nullable,
passwordHash, kcId, isLeitungsteam), Membership.status, GuestAccount,
TeamerInvite, Wahl/Workshop/Teilnehmer/ForceZuteilung/Zuteilung, File,
Chat*, Sync* .
Backend boots against the real DB and the smoke-tested routes (/, guest
login, onboarding invite lookup, protected /api/kc) behave correctly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New global mail/ module mirroring the files/storage/ provider pattern:
- MailProvider abstraction; default LogMailProvider only logs (no delivery),
MAIL_PROVIDER=smtp switches to a nodemailer SMTP transport (SMTP_*,
MAIL_FROM).
- MailService.sendTeamerInvite() composes the invite email with a link
built from APP_BASE_URL.
TeamerService.createInvite() now mails personal invites (those with an
email) best-effort and returns `emailSent`; group links are unchanged.
Delivery failures are logged and swallowed, never blocking invite creation.
New env: APP_BASE_URL, MAIL_PROVIDER, MAIL_FROM, SMTP_HOST/PORT/SECURE/
USER/PASS. Tests: teamer spec covers mail-on-personal-invite,
no-mail-on-group-link, and transport-drop; npm test green at 56. Docs
updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
On every Authentik login the token's `groups` claim is compared against
AUTHENTIK_LEITUNGSTEAM_GROUP (default "Leitungsteam") and mirrored to the
new User.isLeitungsteam column. LT is global, not KC-scoped, so it lives on
the User rather than as a per-KC Membership row: toAuthenticatedUser()
synthesises a virtual global LEITUNGSTEAM membership from the flag, so
RolesGuard / visibility / TeamerService keep working unchanged.
- provision helper gains an isLeitungsteam arg and reconciles the flag both
ways (grant on join, drop when the group is gone), capturing a User
UPDATE to the sync log.
- verifyAuthentikClaims() now also returns isLeitungsteam; strategy, WS
path and onboarding all funnel through the shared helper + mapper.
- new env var AUTHENTIK_LEITUNGSTEAM_GROUP.
Tests: provision-user.spec.ts extended (flag up/down, virtual membership);
npm test green at 55. Docs updated; ops note added that the Authentik
provider must emit the groups claim.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
AuthentikStrategy no longer rejects a valid token whose user has no local
row — it creates the User from the token claims (given_name/family_name/
email) via the new shared resolveOrProvisionAuthentikUser helper, which is
race-safe (P2002 -> re-read) and captures the User to the sync log. The WS
token path (TokenVerificationService.verifyAuthentik) and OnboardingService
now use the same helper, removing three copies of the lookup/create logic.
A provisioned user still has no Membership and therefore no rights: LT role
assignment from Authentik groups is the remaining gap; Verantwortliche go
through the onboarding approval flow.
Tests: provision-user.spec.ts (existing/new/race/rethrow); npm test green
at 51. Docs updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New onboarding/ module. A prospective Verantwortliche/r signs in with their
Konfi-Castle-ID (Authentik), looks up a KC by invite code, picks an existing
Gemeinde, and registers:
- GET /api/onboarding/kc/:inviteCode -> KC name + its Gemeinden (public;
the invite code is the shared secret)
- POST /api/onboarding/verantwortliche -> verifies the raw Authentik bearer
token's claims (no local Membership required yet via new
TokenVerificationService.verifyAuthentikClaims), JIT-provisions the local
User, and creates a Membership with status PENDING. Idempotent per
(user, kc, gemeinde).
- GET /api/onboarding/requests?kcId= (LT) list pending
- POST /api/onboarding/requests/:id/approve|reject (LT) approve flips to
ACTIVE, reject deletes.
Schema: Membership gains status (enum MembershipStatus { ACTIVE, PENDING },
default ACTIVE). AuthentikStrategy / TokenVerificationService / TeamAuthService
now load only ACTIVE memberships, so a pending request grants nothing until
approved. Membership create/update/delete flow through the sync log.
Tests: onboarding.service.spec.ts (14 cases); npm test green at 46.
Docs (plan + backend README) updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Per the updated plan, Gemeinde Teamer are no longer Authentik-backed; they
are local accounts a Gemeinde Verantwortliche/r provisions per KC.
Schema:
- User.authentikSub now nullable; add passwordHash + kcId (cascade from Kc)
so one User model covers Authentik members and local Teamer.
- new TeamerInvite model: shareable group link (email null, maxUses null)
or personal invite (email pinned, single use), with expiry + revoke.
- sync log now also replicates User / Membership / TeamerInvite.
Auth:
- TeamAuthService: bcrypt password login (POST /auth/team-login) and invite
redemption (POST /auth/teamer/register) issuing a JWT signed with
TEAM_JWT_SECRET, payload typ:"team".
- TeamJwtStrategy (AuthGuard('team')) resolves it to the same
AuthenticatedUser shape as AuthentikStrategy.
- TokenVerificationService.verifyEither() also accepts team tokens (WS).
- files + chat read endpoints accept 'team' tokens; Teamer see non-Konfi
files and can use chat / start DMs.
Teamer admin (teamer/ module, under /gemeinde/:gemeindeId):
- POST/GET teamer, DELETE teamer/:userId
- POST/GET teamer-invites, DELETE teamer-invites/:inviteId
- LT may manage any Gemeinde; a Verantwortliche/r only their own
(checked in TeamerService, since RolesGuard only scopes by kcId).
Tests: TeamAuthService + TeamerService specs added (Prisma/Sync mocked),
npm test green at 32. Docs (plan + backend README) updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First automated tests in the backend. Fakes Prisma + SyncService in
memory and asserts on the zuteilung.createMany payload:
- Force-Zuteilung wins over participant wishes
- wish-round fallback when a workshop hits capacity
- participant left unassigned when nothing is free
- underfilled-workshop consolidation reassigns via remaining wishes
- workshop exactly meeting minTeilnehmer is kept
- one CREATE sync entry captured per resulting Zuteilung
npm test green (9 tests). Plan verification section updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Fills the plan's known gap where Gemeinde existed only as a Prisma model.
GemeindeModule exposes Leitungsteam-only create/list/get/update/delete
under /api/gemeinde, each mutation captured into the sync log like the
other feature services. Unique-name-per-KC violations surface as 409.
Docs (plan + backend README) updated to drop the gap and next-step item.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add package.json for backend dependencies and scripts.
- Create Prisma schema for multi-tenant event management.
- Implement main application module and configure global settings.
- Develop authentication module with JWT and Authentik integration.
- Create DTOs for guest account creation and KC management.
- Implement role-based access control with custom guards and decorators.
- Add services and controllers for managing KCs and guest accounts.
- Set up global validation and CORS in the main application entry point.
- Establish Prisma module for database access throughout the application.
- Document project plan and architecture for multi-tenant platform.
linusandClaude Sonnet 5